Skip to main content

Bun home page

[Runtime

](../../../index.md)[Package Manager

](../../../pm/cli/install/index.md)[Bundler

](../../../bundler/index.md)[Test Runner

](../../../test/index.md)[Guides

](../../index.md)[Reference

](https://bun.com/reference)[Blog

](https://bun.com/blog)[Feedback

](../../../feedback/index.md)

The Bun.escapeHTML() utility can be used to escape HTML characters in a string. The following replacements are made.

• " becomes """
• & becomes "&"
• ' becomes "'"
• < becomes "<"
• > becomes ">"

This function is optimized for large input. Non-string types will be converted to a string before escaping.

Bun.escapeHTML("<script>alert('Hello World!')</script>");
// &lt;script&gt;alert(&#x27;Hello World!&#x27;)&lt;&#x2F;script&gt;

See Docs > API > Utils for more useful utilities.

Was this page helpful?

Suggest editsRaise issue

[

Compress and decompress data with DEFLATE

Previous

](../deflate/index.md)[

Check if two objects are deeply equal

Next

](../deep-equals/index.md)