To prevent any user-entered content from being interpreted as HTML, I need to escape it so that special characters like < become < in the markup. However, I still want to wrap the escaped content with actual HTML tags. The goal is to ensure that the HTML remains trustworthy even after escaping the user input.
Here is an example of the html code snippet:
<span ng-bind-html="trustHtml(notif.getConditionText())"></span>
Controller:
$scope.trustHtml = function(html) {
return $sce.trustAsHtml(html);
}
Notif:
getConditionText: function() {
return "<b>" + $sanitize(this.name) + "</b>";
}
I am searching for a method that can replace $sanitize and escape the user-entered "name" property value. For instance, if the user enters Seattle <rocks>
, it should output the HTML as Seattle <rocks>
.
Does anyone know of a solution like this for Angular?
Please note that I am not aiming to encode the characters into URI entities, but specifically into HTML entities.