http.forms

html_escape(str) -> escaped

Escape a string for safe embedding in HTML text or a quoted attribute

Replaces the five HTML specials: & with &, < with <, > with >, " with " and ' with '.

One pass escapes each character once, so an entity in the input is escaped as text: & gives &. It is not an HTML sanitizer.