Escape HTML entities

The moment you build markup from a string, unescaped user input becomes an injection bug. Server-side renderers and template engines escape by default; when you build HTML by hand you have to do it yourself.

Implement escapeHtml(input). Replace, in this order, & with &, < with <, > with >, " with " and ' with '. Every occurrence is replaced, not just the first.

The ampersand must be replaced first, so text that already contains an entity is escaped again: "<" becomes "<". If input is null or undefined, return the empty string ""; any other non-string value is converted with String(input) before escaping.

What it has to do

• Replace all five characters & < > " ' with & < > " ' respectively.
• Replace every occurrence, not just the first.
• Escape ampersands first, so < becomes <.
• Return "" for null and undefined input.
• Leave text with none of those characters untouched.

Your workspace