HTML-encoding in JavaScript/jQuery

demo

When using JavaScript to pull a value out from a hidden field and display it in a textbox. If the value in the hidden field is encoded(like "chalk & cheese" ), The problem is that when you read value from the hidden field, JavaScript seems to lose the encoding. To escape " and ', how to make the encoding to remain. (Especially for quote marks
" and
') and white space.

The jQuery trick doesn't encode quote marks and in IE it will strip your whitespace.
Based on the escape templatetag in Django, which I guess is heavily used/tested already, I made this function which does what's needed.
It's arguably simpler (and possibly faster) than any of the workarounds for the whitespace-stripping issue - and it encodes quote marks, which is essential if you're going to use the result inside an attribute value for example.

1. function htmlEscape(str) {
   
2.     return String(str)
   
3.             .replace(/&/g, '&')
   
4.             .replace(/"/g, '"')
   
5.             .replace(/'/g, ''')
   
6.             .replace(/</g, '<')
   
7.             .replace(/>/g, '>');
   
8. }
   
9. 
   
10. function htmlUnescape(value){
    
11.     return String(value)
    
12.         .replace(/"/g, '"')
    
13.         .replace(/'/g, "'")
    
14.         .replace(/</g, '<')
    
15.         .replace(/>/g, '>')
    
16.         .replace(/&/g, '&');
    
17. }

复制代码

Update 2013-06-17:
In the search for the fastest escaping I have found this implementation of a replaceAll method:
http://dumpsite.com/forum/index.php?topic=4.msg29#msg29
(also referenced here: http://stackoverflow.com/a/6714233/202168)
Some performance results here:
http://jsperf.com/htmlencoderegex/25
It gives identical result string to the builtin replace chains above.

From: stackoverflow

demo

trick there in source code. replace the first parameters for the first block with

1. function htmlEscape(str) {
   
2.     return String(str)
   
3.             .replace(/&/g, '&amp;')
   
4.             .replace(/"/g, '&quot;')
   
5.             .replace(/'/g, '&#39;')
   
6.             .replace(/</g, '&lt;')
   
7.             .replace(/>/g, '&gt;');
   
8. }
   
9. 
   
10. function htmlUnescape(value){
    
11.     return String(value)
    
12.         .replace(/&quot;/g, '"')
    
13.         .replace(/&#39;/g, "'")
    
14.         .replace(/&lt;/g, '<')
    
15.         .replace(/&gt;/g, '>')
    
16.         .replace(/&amp;/g, '&');
    
17. }
    

复制代码

demo

for reasons why not to use \&apos;  instead of &#39; . see: stackoverflow.com/questions/2083754/… blogs.msdn.com/b/kirillosenkov/archive/2010/03/19/… fishbowl.pastiche.org/2003/07/01/the_curse_of_apos