Function escapeHtml

Escapes a value for HTML text and for (double or single quoted) HTML attribute values: &, <, >, " and ' become entities; null and undefined become an empty string.

Use it whenever data (cell values, labels, ids from the server …) is written into innerHTML – otherwise a value like <img src=x onerror=alert(1)> is executed as markup (HTML injection / XSS), and a " cuts an attribute value.

Example

// in a cell renderer
const cellDiv = document.createElement('div');
const cellValue = 'Tom & Jerry <3';
cellDiv.innerHTML = `<div class="my-label" title="${escapeHtml(cellValue)}">${escapeHtml(cellValue)}</div>`;
Copy

Example

escapeHtml('<b>"Tom" & Jerry</b>'); // "&lt;b&gt;&quot;Tom&quot; &amp; Jerry&lt;/b&gt;"
Copy