<p>Does anyone know of an easy way to escape HTML from strings in <a href="http://jquery.com/" rel="noreferrer">jQuery</a>?  I need to be able to pass an arbitrary string and have it properly escaped for display in an HTML page (preventing JavaScript/HTML injection attacks).  I'm sure it's possible to extend jQuery to do this, but I don't know enough about the framework at the moment to accomplish this.</p>

If you're escaping for HTML, there are only three that I can think of that would be really necessary:
```
```
html.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
```
```
Depending on your use case, you might also need to do things like
```
"
```
to
```
&quot;
```
.  If the list got big enough, I'd just use an array:
```
```
var escaped = html;
var findReplace = [[/&/g, "&amp;"], [/</g, "&lt;"], [/>/g, "&gt;"], [/"/g, "&quot;"]]
for(var item in findReplace)
    escaped = escaped.replace(findReplace[item][0], findReplace[item][1]);
```
```
```
encodeURIComponent()
```
will only escape it for URLs, not for HTML.