🔐 @xof/escape-html

Fast, lightweight HTML escape and unescape utility for Node.js.

Support:

• ✅ CommonJS
• ✅ ES Module (ESM)
• ✅ HTML entity encoding
• ✅ HTML entity decoding
• ✅ Unicode entity support
• ✅ Zero dependencies

Installation

npm install @xof/escape-html

Usage

CommonJS

const html = require('@xof/escape-html');

console.log(
  html.escape('<h1>Hello World</h1>')
);

Output:

<h1>Hello World</h1>

ES Module

import html from '@xof/escape-html';

console.log(
  html.escape('<h1>Hello World</h1>')
);

or:

import {
  escape,
  unescape
} from '@xof/escape-html';

console.log(
  escape('<script>alert("x")</script>')
);

API

escape(text)

Convert dangerous HTML characters into HTML entities.

Example:

html.escape(
  '<script>alert("XSS")</script>'
);

Result:

<script>alert("XSS")</script>

unescape(text, options)

Decode HTML entities back into normal characters.

Example:

html.unescape(
  '<h1>Hello&World</h1>'
);

Result:

<h1>Hello&World</h1>

Supported Entities

Basic

&  →
&lt;   <
&gt;   >
&quot; "
&apos; '

Named Entities

 
©
®
™
…
«
»
€

Example:

html.unescape('© 2026');

Output:

© 2026

Numeric Entities

Supported:

Decimal

©

Result:

©

Hexadecimal

©

Result:

©

Unicode characters are also supported:

html.unescape('🦊');

Output:

🦊

Strict Mode

By default unknown entities are decoded as text.

html.unescape(
  '&unknown;',
  {
    strict: true
  }
);

Result:

&unknown;

Functions

| Function | Description | |-|-| | escape() | Encode HTML characters | | unescape() | Decode HTML entities | | encodeURIHTML() | Escape HTML and encode spaces |

Example

const {
  escape,
  unescape
} = require('@xof/escape-html');

const safe = escape(
  '<img src="x">'
);

console.log(safe);

console.log(
  unescape(safe)
);

Output:

<img src="x">

<img src="x">

Features

• ⚡ Lightweight
• 📦 No dependencies
• 🔒 Helps prevent HTML injection
• 🌐 Browser and Node.js friendly
• 🧩 ESM + CommonJS support

License

MIT © XOF