EasyPro challengeJavaScriptTypeScript
Escape HTML
BackendSecurityStrings
The function below renders user-controlled content directly into an HTML string.
The bug: an attacker can inject <script>alert('XSS')</script> as the argument and execute arbitrary JavaScript in the user's browser.
Your task: fix solve(str) so that every HTML special character is escaped before being returned.
| Character | Escaped form |
|---|---|
& | & |
< | < |
> | > |
" | " |
' | ' |
Safe strings must pass through unchanged.
Sample tests
Test #1Script tag injection
Input: ["<script>alert(1)</script>"]
Output: "<script>alert(1)</script>"
Test #2Double quotes
Input: ["\"hello\""]
Output: ""hello""
Test #3Single quote
Input: ["it's fine"]
Output: "it's fine"
Test #4Safe string — no change
Input: ["Hello World"]
Output: "Hello World"