basicXSSProtection.ts

const str = "<svg onload=alert(1)>";
const host = typeof document !== 'undefined' ? document.createElement("p") : undefined;
let converted
if (host) {
    host.textContent = str;
    converted = host.innerHTML;
} else {
    converted = str.replaceAll('<', '&lt;').replaceAll('>', '&gt;')
}
console.log(converted)