escapeHTML.js

escapeHTML = (html = '') => {

	// Ensure that html is a string
	html += ''

	// Escape all critical characters
	html = html.replace(/&/g, '&')
	           .replace(/</g, '&lt;')
	           .replace(/>/g, '&gt;')
	           .replace(/"/g, '&quot;')
	           .replace(/'/g, '&#039;')
	           .replace(/`/g, '&#96;')

	return html

}

Example:

let htmlString = `<script>alert('XSS')</script>`,
    output     = escapeHTML(htmlString)

console.log(output)

Output:

<script>alert('Hello XSS')</script>