String & HTML

Helpers for escaping and normalizing untrusted strings and URLs.

• escapeHtml: escapes the five HTML-significant characters for safe HTML text content.
• escapeAttr: escapes a value for safe interpolation into a double-quoted HTML attribute.
• sanitizeUrl: sanitizes a URL against a scheme allow-list, rejecting disallowed schemes.
• upperFirst: uppercases the first character of a string.