escapeHtml function

String escapeHtml(String input)

Escapes special HTML characters in text content and attribute values to prevent XSS.

Encodes & (&), < (<), > (>), " ("), and ' ('). This function is applied automatically during SSR rendering for all element text nodes, class names, style strings, and attribute values.

final safe = escapeHtml('<script>alert("xss")</script>');
// Returns: '&lt;script&gt;alert(&quot;xss&quot;)&lt;/script&gt;'

Implementation

String escapeHtml(String input) {
  return input
      .replaceAll('&', '&')
      .replaceAll('<', '&lt;')
      .replaceAll('>', '&gt;')
      .replaceAll('"', '&quot;')
      .replaceAll("'", '&#x27;');
}