Title: @wordpress/escape-html
Published: March 9, 2021
Last modified: September 16, 2026
---
# @wordpress/escape-html
## In this article
* [Installation](https://developer.wordpress.org/block-editor/reference-guides/packages/packages-escape-html/?output_format=md#installation)
* [API](https://developer.wordpress.org/block-editor/reference-guides/packages/packages-escape-html/?output_format=md#api)
- [escapeAmpersand](https://developer.wordpress.org/block-editor/reference-guides/packages/packages-escape-html/?output_format=md#escapeampersand)
- [escapeAttribute](https://developer.wordpress.org/block-editor/reference-guides/packages/packages-escape-html/?output_format=md#escapeattribute)
- [escapeEditableHTML](https://developer.wordpress.org/block-editor/reference-guides/packages/packages-escape-html/?output_format=md#escapeeditablehtml)
- [escapeHTML](https://developer.wordpress.org/block-editor/reference-guides/packages/packages-escape-html/?output_format=md#escapehtml)
- [escapeLessThan](https://developer.wordpress.org/block-editor/reference-guides/packages/packages-escape-html/?output_format=md#escapelessthan)
- [escapeQuotationMark](https://developer.wordpress.org/block-editor/reference-guides/packages/packages-escape-html/?output_format=md#escapequotationmark)
- [isValidAttributeName](https://developer.wordpress.org/block-editor/reference-guides/packages/packages-escape-html/?output_format=md#isvalidattributename)
* [Contributing to this package](https://developer.wordpress.org/block-editor/reference-guides/packages/packages-escape-html/?output_format=md#contributing-to-this-package)
[ Back to top](https://developer.wordpress.org/block-editor/reference-guides/packages/packages-escape-html/?output_format=md#wp--skip-link--target)
Escape HTML utils.
## [Installation](https://developer.wordpress.org/block-editor/reference-guides/packages/packages-escape-html/?output_format=md#installation)
Install the module
```bash
npm install @wordpress/escape-html
```
_This package assumes that your code will run in an **ES2015+** environment. If
you’re using an environment that has limited or no support for such language features
and APIs, you should include [the polyfill shipped in `@wordpress/babel-preset-default`](https://github.com/WordPress/gutenberg/tree/HEAD/packages/babel-preset-default#polyfill)
in your code._
## [API](https://developer.wordpress.org/block-editor/reference-guides/packages/packages-escape-html/?output_format=md#api)
### [escapeAmpersand](https://developer.wordpress.org/block-editor/reference-guides/packages/packages-escape-html/?output_format=md#escapeampersand)
Returns a string with ampersands escaped. Note that this is an imperfect implementation,
where only ampersands which do not appear as a pattern of named, decimal, or hexadecimal
character references are escaped. Invalid named references (i.e. ambiguous ampersand)
are still permitted.
_Related_
* [https://w3c.github.io/html/syntax.html#character-references](https://w3c.github.io/html/syntax.html#character-references)
* [https://w3c.github.io/html/syntax.html#ambiguous-ampersand](https://w3c.github.io/html/syntax.html#ambiguous-ampersand)
* [https://w3c.github.io/html/syntax.html#named-character-references](https://w3c.github.io/html/syntax.html#named-character-references)
_Parameters_
* _value_ `string`: Original string.
_Returns_
* `string`: Escaped string.
### [escapeAttribute](https://developer.wordpress.org/block-editor/reference-guides/packages/packages-escape-html/?output_format=md#escapeattribute)
Returns an escaped attribute value.
_Related_
* [https://w3c.github.io/html/syntax.html#elements-attributes](https://w3c.github.io/html/syntax.html#elements-attributes)“[…]
the text cannot contain an ambiguous ampersand […] must not contain
any literal
U+0022 QUOTATION MARK characters (“)”
Note we also escape the greater than symbol, as this is used by wptexturize to
split HTML strings. This is a WordPress specific fix
Note that if a resolution for Trac#45387 comes to fruition, it is no longer
necessary
for `__unstableEscapeGreaterThan` to be used.
Note we also escape the less-than symbol to prevent HTML injection vulnerabilities
and parsing issues, particularly for users without the unfiltered_html capability.
See: [https://core.trac.wordpress.org/ticket/45387](https://core.trac.wordpress.org/ticket/45387)
_Parameters_
* _value_ `string`: Attribute value.
_Returns_
* `string`: Escaped attribute value.
### [escapeEditableHTML](https://developer.wordpress.org/block-editor/reference-guides/packages/packages-escape-html/?output_format=md#escapeeditablehtml)
Returns an escaped Editable HTML element value. This is different from `escapeHTML`,
because for editable HTML, ALL ampersands must be escaped in order to render the
content correctly on the page.
_Parameters_
* _value_ `string`: Element value.
_Returns_
* `string`: Escaped HTML element value.
### [escapeHTML](https://developer.wordpress.org/block-editor/reference-guides/packages/packages-escape-html/?output_format=md#escapehtml)
Returns an escaped HTML element value.
_Related_
* [https://w3c.github.io/html/syntax.html#writing-html-documents-elements](https://w3c.github.io/html/syntax.html#writing-html-documents-elements)“
the text must not contain the character U+003C LESS-THAN SIGN (\<) or an
ambiguous
ampersand.”
_Parameters_
* _value_ `string`: Element value.
_Returns_
* `string`: Escaped HTML element value.
### [escapeLessThan](https://developer.wordpress.org/block-editor/reference-guides/packages/packages-escape-html/?output_format=md#escapelessthan)
Returns a string with less-than sign replaced.
_Parameters_
* _value_ `string`: Original string.
_Returns_
* `string`: Escaped string.
### [escapeQuotationMark](https://developer.wordpress.org/block-editor/reference-guides/packages/packages-escape-html/?output_format=md#escapequotationmark)
Returns a string with quotation marks replaced.
_Parameters_
* _value_ `string`: Original string.
_Returns_
* `string`: Escaped string.
### [isValidAttributeName](https://developer.wordpress.org/block-editor/reference-guides/packages/packages-escape-html/?output_format=md#isvalidattributename)
Returns true if the given attribute name is valid, or false otherwise.
_Parameters_
* _name_ `string`: Attribute name to test.
_Returns_
* `boolean`: Whether attribute is valid.
## [Contributing to this package](https://developer.wordpress.org/block-editor/reference-guides/packages/packages-escape-html/?output_format=md#contributing-to-this-package)
This is an individual package that’s part of the Gutenberg project. The project
is organized as a monorepo. It’s made up of multiple self-contained software packages,
each with a specific purpose. The packages in this monorepo are published to [npm](https://www.npmjs.com/)
and used by [WordPress](https://make.wordpress.org/core/) as well as other software
projects.
To find out more about contributing to this package or Gutenberg as a whole, please
read the project’s main [contributor guide](https://github.com/WordPress/gutenberg/tree/HEAD/CONTRIBUTING.md).
First published
March 9, 2021
Last updated
September 16, 2026
Edit article
[ Improve it on GitHub: @wordpress/escape-html ](https://github.com/WordPress/gutenberg/edit/trunk/packages/escape-html/README.md)
[ Previous: @wordpress/env](https://developer.wordpress.org/block-editor/reference-guides/packages/packages-env/)
[ Next: @wordpress/eslint-plugin](https://developer.wordpress.org/block-editor/reference-guides/packages/packages-eslint-plugin/)