Function escapeHtml

escapeHtml(str: string | null | undefined): string
Escape dangerous HTML characters to prevent XSS.
Parameters
- str: string | null | undefined
  The string to escape. Null or undefined returns "".
Returns string
The HTML-escaped string, safe for use in DOM text contexts.

Security
Escapes &, <, > via a text node's HTML serialization — safe for HTML TEXT / element-content contexts. It does NOT escape the quotes " and '; for an attribute-value context use escapeAttribute, which escapes all five. (An earlier version of this line claimed the quotes were escaped — they are not.)
- Defined in packages/core/src/kernel/security/escaping.ts:34