codejump
EasyJavaScriptTypeScript

Escape HTML — XSS Prevention

TypeScriptSecurityXSS

The function below renders user-controlled content directly into an HTML string.

The bug: an attacker can inject <script>alert('XSS')</script> as the argument and execute arbitrary JavaScript in the victim's browser — Cross-Site Scripting, one of the most common web vulnerabilities.

Your task: fix solve(str) so every HTML special character is escaped before being returned.

CharacterEscaped form
&&amp;
<&lt;
>&gt;
"&quot;
'&#39;

Safe strings must pass through unchanged.

Sample tests

Test #1Script tag injection
Input: ["<script>alert(1)</script>"]
Output: "&lt;script&gt;alert(1)&lt;/script&gt;"
Test #2Double quotes
Input: ["\"hello\""]
Output: "&quot;hello&quot;"
Test #3Single quote
Input: ["it's fine"]
Output: "it&#39;s fine"
Test #4Safe string — no change
Input: ["Hello World"]
Output: "Hello World"
← All challenges