Question

Does anyone know of an easy way to escape HTML from strings in jQuery? I need to be able to pass an arbitrary string and have it properly escaped for display in an HTML page (preventing JavaScript/HTML injection attacks). I’m sure it’s possible to extend jQuery to do this, but I don’t know enough about the framework at the moment to accomplish this.

Answer 1

Since you’re using jQuery, you can just set the element’s text property:

// before: // <div class='someClass'>text</div> var someHtmlString = '<script>alert('hi!');</script>';  // set a DIV's text: $('div.someClass').text(someHtmlString); // after:  // <div class='someClass'>&lt;script&gt;alert('hi!');&lt;/script&gt;</div>  // get the text in a string: var escaped = $('<div>').text(someHtmlString).html(); // value:  // &lt;script&gt;alert('hi!');&lt;/script&gt;