codejump
EasyJavaScriptTypeScript

Escape HTML

Node.jsSecurityStrings

The function below renders user-controlled content directly into an HTML string.

The bug: an attacker can inject <script>alert('XSS')</script> as the argument and execute arbitrary JavaScript in the user's browser.

Your task: fix solve(str) so that every HTML special character is escaped before being returned.

CharacterEscaped form
&&amp;
<&lt;
>&gt;
"&quot;
'&#39;

Safe strings must pass through unchanged.

Sample tests

Test #1Script tag injection
Input: ["<script>alert(1)</script>"]
Output: "&lt;script&gt;alert(1)&lt;/script&gt;"
Test #2Double quotes
Input: ["\"hello\""]
Output: "&quot;hello&quot;"
Test #3Single quote
Input: ["it's fine"]
Output: "it&#39;s fine"
Test #4Safe string — no change
Input: ["Hello World"]
Output: "Hello World"
← All challenges