Documentation
¶
Overview ¶
Package escapehtml escapes the HTML-significant characters in a string so it can be safely embedded in HTML markup, a port of the npm "escape-html" package that Express uses when rendering error pages and other user-influenced text. It exposes the single Escape function and depends on only the Go standard library.
Escaping is the baseline defense against HTML injection and cross-site scripting. Any time untrusted or merely unpredictable text — a form value, a filename, a database field, an error message — is placed into an HTML document or an attribute value, the characters that HTML treats specially must be turned into entities so a browser renders them as literal text instead of interpreting them as tags or attribute delimiters. Escape gives you exactly that conversion in one call.
Escape rewrites the five characters that escape-html handles: & becomes &, < becomes <, > becomes >, " becomes ", and ' becomes ' (the numeric entity for the apostrophe). Ampersand is converted first in effect — because it is matched and replaced along with the others in a single pass — so an existing entity in the input has its leading & escaped too and nothing is double-interpreted. Escaping both quote characters means the result is safe to drop into either a single- or double-quoted attribute value, not just element text.
The implementation is allocation-conscious and precise. It first scans for any of the five characters and, finding none, returns the original string unchanged with no allocation; this makes the common case of already-safe text cheap. When a special character is present it copies the safe prefix and then rewrites the remainder byte by byte. Because the five characters are all ASCII and the transform operates a byte at a time, multi-byte UTF-8 sequences are passed through untouched, so non-ASCII text such as accented letters or emoji survives verbatim. The empty string returns the empty string.
Parity with the Node original is exact for the character set and the entity spellings: the same five characters map to the same entities, and text lacking them is returned as-is. The only differences are idiomatic — Escape takes and returns a Go string rather than coercing a JavaScript value, and it is a pure function with no configuration. Note the deliberately narrow scope: this is HTML body/attribute escaping only, not a URL, JavaScript-string, or CSS encoder, so it must not be relied upon to sanitize values destined for those other contexts.
Index ¶
Examples ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Escape ¶
Escape returns s with the HTML-significant characters &, <, >, ", and ' replaced by their entity equivalents:
& -> & < -> < > -> > " -> " ' -> '
If s contains none of these characters, it is returned unchanged.
Example ¶
ExampleEscape rewrites the five HTML-significant characters into their entity equivalents so untrusted text can be embedded safely in markup. The ampersand becomes &, the angle brackets become < and >, the double quote becomes ", and the apostrophe becomes '. Escaping both quote characters means the result is safe in element text and in attribute values alike. This is the baseline defense against HTML injection.
package main
import (
"fmt"
"github.com/malcolmston/express/escapehtml"
)
func main() {
fmt.Println(escapehtml.Escape(`<a href="x">Tom & Jerry's</a>`))
}
Output: <a href="x">Tom & Jerry's</a>
Example (Passthrough) ¶
ExampleEscape_passthrough shows that text containing none of the five special characters is returned unchanged, with no allocation. Only &, <, >, ", and ' are rewritten; letters, digits, punctuation, and multi-byte UTF-8 such as accented characters or emoji pass through verbatim. Here a plain sentence is returned exactly as given.
package main
import (
"fmt"
"github.com/malcolmston/express/escapehtml"
)
func main() {
fmt.Println(escapehtml.Escape("Café ☕ time"))
}
Output: Café ☕ time
Types ¶
This section is empty.
Source Files