encoding.html

HTML cannot hold a bare < or & in its text, so they travel as entities: <, &, é or a number such as é and é. Unescape turns every entity in a string back into the character it names; Escape and EscapeText go the other way. Use them when you read text out of a page or a feed, and when you put text of unknown origin into a page.

Unescape follows the HTML5 rules the way Python's html.unescape does, and gives the same answer on every input tried against it: all the named entities of the HTML standard (including the ones that stand for two characters), decimal and hexadecimal numbers, the older names that browsers accept without the closing ; (&copy, &amp), numbers 128 to 159 read as Windows-1252 characters, and the replacement character for �, surrogates and numbers beyond Unicode. Anything that is not an entity stays as it is.

What people get wrong:

• Unescaping text before using it as HTML. After Unescape the text is plain text again; if it goes back into a page, escape it again.
• Using EscapeText inside an attribute. It leaves quotes alone, so a value with " in it breaks out of href="...". Use Escape for attributes.
• Expecting Escape to make a URL or a script safe. It only protects the places where HTML text or a quoted attribute goes. A javascript: link or text inside <script> needs more than escaping.
• Unescaping twice. < is the text <; one pass gives that, a second pass would give <.

The template package has its own EscapeHTML; for XML text and attributes see encoding.xml.

Escaping and getting the text back

Escaping and unescaping are inverses: whatever Escape produces, Unescape turns back into the original. The example escapes three comments and checks the round trip.

import encoding.html

func main:
    comments := ["5 < 6 && 7 > 3", `say "hi" & wave`, "it's <b>bold</b>"]
    each comment in comments:
        escaped := html.Escape(comment)
        println escaped
        println html.Unescape(escaped) == comment
    end
end

Building markup from untrusted text

A name that comes from a user can hold &, < or a quote. Put it in a tag's text with EscapeText and in an attribute value with Escape, which also covers both kinds of quote. In the other direction, text scraped from a page has to go through Unescape before it is compared or shown.

import encoding.html

func card(name: str, note: str): str:
    ret `<div class="card" title="` + html.Escape(name) + `"><h2>` + html.EscapeText(name) + `</h2><p>` + html.EscapeText(note) + `</p></div>`
end

func main:
    println card("Tom & Jerry", "<b>not bold</b>")
    println card(`He said "hi"`, "it's fine")
    scraped := "Jos&eacute; &lt;open&gt; &amp; 5 &lt; 6 &#8211; &euro;3"
    println html.Unescape(scraped)
end

Functions

func Unescape(s: str): str

import encoding.html

func main:
    page := "<p>Fiancé & crème — €5</p>"
    println html.Unescape(page)
    println html.Unescape("Tom & Jerry &copy 2026, a &lt b")
    safe := html.Escape(`<a href="x">it's</a>`)
    println safe
    println html.EscapeText(`<a href="x">it's</a>`)
    println html.Unescape(safe)
end

func Escape(s: str): str

func EscapeText(s: str): str