Escapes an error message for HTML display and caps its length.
Escapes & < > " ', then truncates to maxLength and appends an ellipsis. Intended for
messages that may embed user input and are about to reach the DOM — a server error echoing
a submitted value is the usual case.
⚠️ This escapes text, it is not a sanitiser for markup: it is safe for text content and
attribute values, not for injecting HTML. For anything richer, go through
security/dom-security. ⚠️ Truncation happens after escaping, so an entity can be cut
mid-sequence; the result is safe but may end on a stray fragment.
Parameters
message: unknown
Value to render; non-strings are stringified, null-ish yields
"Unknown error".
maxLength: number = MAX_ERROR_MESSAGE_LENGTH
Maximum length before truncation. Defaults to 500.
Escapes an error message for HTML display and caps its length.
Escapes
& < > " ', then truncates tomaxLengthand appends an ellipsis. Intended for messages that may embed user input and are about to reach the DOM — a server error echoing a submitted value is the usual case.⚠️ This escapes text, it is not a sanitiser for markup: it is safe for text content and attribute values, not for injecting HTML. For anything richer, go through
security/dom-security. ⚠️ Truncation happens after escaping, so an entity can be cut mid-sequence; the result is safe but may end on a stray fragment.