/* The `<` char should be escaped, unless it is a part of HTML tag.
548641
function(walk) {
    if (!walk.at("<")) return false;
    if (this.tryHtmlTag(walk)) return true;
    if (this.tryHtmlComment(walk)) return true;
    // Not HTML tag -- escaping <
    this.out.push("&lt;");
    walk.skip();
    return true;
  }
236251
public static String escapeHtml(String htmlString) {
		StringBuffer sb = new StringBuffer(htmlString.length());
		// true if last char was blank
		boolean lastWasBlankChar = false;
		int len = htmlString.length();
		char c;

		for (int i = 0; i < len; i++)
		{
			c = htmlString.charAt(i);
			if (c == ' ') {
				// blank gets extra work,
				// this solves the problem you get if you replace all
				// blanks with &nbsp;, if you do that you loss
				// word breaking
				if (lastWasBlankChar) {
					lastWasBlankChar = false;
					sb.append("&nbsp;");
				}
				else {
					lastWasBlankChar = true;
					sb.append(' ');
				}
			}
			else {
				lastWasBlankChar = false;
				//
				// HTML Special Chars
				if (c == '"')
					sb.append("&quot;");
				else if (c == '&')
					sb.append("&amp;");
				else if (c == '<')
					sb.append("&lt;");
				else if (c == '>')
					sb.append("&gt;");
				else if (c == '/')
					sb.append("-");
				else if (c == '\\')
					sb.append("-");
				else if (c == '\n')
					// Handle Newline
					sb.append("&lt;br/&gt;");
				else {
					int ci = 0xffff & c;
					if (ci < 160 )
						// nothing special only 7 Bit
						sb.append(c);
					else {
						// Not 7 Bit use the unicode system
						sb.append("&#");
						sb.append(String.valueOf(ci));
						sb.append(';');
					}
				}
			}
		}
		return sb.toString();
	}
828574
protected String escapeXmlSpecialCharacters(String url) {
		// https://stackoverflow.com/questions/1091945/what-characters-do-i-need-to-escape-in-xml-documents
		return url
				.replace("&", "&amp;") // must be escaped first!!!
				.replace("\"", "&quot;")
				.replace("'", "&apos;")
				.replace("<", "&lt;")
				.replace(">", "&gt;");
	}
1242633
public String escape(String name, String html) {

        if (html == null) {
            return null;
        }
        if (m_exceptions.contains(name)) {
            return html;
        }
        LOG.info("Escaping parameter '" + name + "' with value '" + html + "'");
        if (m_cleanHtml.contains(name)) {
            return filterAntiSamy(html);
        }
        return CmsEncoder.escapeXml(html);
    }
199014
private static String escapeHtmlChars(String s) {
        for (int i = 0; i < s.length(); i++) {
            char ch = s.charAt(i);
            switch (ch) {
                // only start building a new string if we need to
                case '<': case '>': case '&':
                    StringBuilder sb = new StringBuilder(s.substring(0, i));
                    for ( ; i < s.length(); i++) {
                        ch = s.charAt(i);
                        switch (ch) {
                            case '<': sb.append("&lt;");  break;
                            case '>': sb.append("&gt;");  break;
                            case '&': sb.append("&amp;"); break;
                            default:  sb.append(ch);      break;
                        }
                    }
                    return sb.toString();
            }
        }
        return s;
    }
1133567
def _surface_escape(code, char):
        
        replacement = str(HTMLEntity(value=ord(char)))
        for node in code.filter_text(recursive=False):
            if char in node:
                code.replace(node, node.replace(char, replacement), False)
209530
static String escapeJSCurly(String re) {
		re = re.replaceAll("(?<!\\\\)\\{(?!\\d)", "\\\\{");
		re = re.replaceAll("(?<!(\\d,?|\\\\))\\}", "\\\\}");
		return re;
	}
44545
function (str) {
            return _(str).chain()
                .unescapeHTML()
                .stripTags()
                .clean()
                .value()
                .replace( matchJunk, '' )
                .toLowerCase();
        }
911181
public static String htmlEncode(String input)
	{
		if (input == null)
		{
			return "";
		}
		StringBuffer retval = new StringBuffer(input);
		StringSupport.replaceAll(retval, "&", "&amp;");
		StringSupport.replaceAll(retval, "<", "&lt;");
		StringSupport.replaceAll(retval, ">", "&gt;");
		StringSupport.replaceAll(retval, "\"", "&quot;");
		return retval.toString();
	}
932269
static String jsRegExpToJavaRegExp(String re) {
		re = re.replaceAll("\\[\\^\\\\\\d\\]", ".");
		re = re.replaceAll("\\[([^\\]]*)\\\\b([^\\]]*)\\]", "[$1\\\\cH$2]"); // [...\b...]
																				// ->
																				// [...\cH...]
		re = re.replaceAll("(?<!\\\\)\\[([^((?<!\\\\)\\[)\\]]*)\\[", "[$1\\\\["); // [...[...]
																					// ->
																					// [...\[...]

		// back reference in character classes are simply ignored by browsers
		re = re.replaceAll("(?<!\\\\)\\[([^\\]]*)(?<!\\\\)\\\\\\d", "[$1"); // [...ab\5cd...]
																			// ->
																			// [...abcd...]

		// characters escaped without need should be "un-escaped"
		re = re.replaceAll("(?<!\\\\)\\\\([ACE-RT-VX-Zaeg-mpqyz])", "$1");

		re = escapeJSCurly(re);
		return re;
	}
269370
private static String unescapeHtml(final String input) {
        StringBuilder writer = null;
        int len = input.length();
        int i = 1;
        int st = 0;
        while (true) {
            // look for '&'
            while (i < len && input.charAt(i-1) != '&') {
                i++;
            }
            if (i >= len) {
                break;
            }

            // found '&', look for ';'
            int j = i;
            while (j < len && j < i + MAX_ESCAPE + 1 && input.charAt(j) != ';') {
                j++;
            }
            if (j == len || j < i + MIN_ESCAPE || j == i + MAX_ESCAPE + 1) {
                i++;
                continue;
            }

            // found escape
            if (input.charAt(i) == '#') {
                // numeric escape
                int k = i + 1;
                int radix = 10;

                final char firstChar = input.charAt(k);
                if (firstChar == 'x' || firstChar == 'X') {
                    k++;
                    radix = 16;
                }

                try {
                    int entityValue = Integer.parseInt(input.substring(k, j), radix);

                    if (writer == null) {
                        writer = new StringBuilder(input.length());
                    }
                    writer.append(input.substring(st, i - 1));

                    if (entityValue > 0xFFFF) {
                        final char[] chrs = Character.toChars(entityValue);
                        writer.append(chrs[0]);
                        writer.append(chrs[1]);
                    }
                    else if(entityValue == 39) {
                        writer.append('\'');
                    }
                    else {
                        writer.append(entityValue);
                    }

                }
                catch (NumberFormatException ex) {
                    i++;
                    continue;
                }
            }
            else {
                // named escape
                CharSequence value = LOOKUP_MAP.get(input.substring(i, j));
                if (value == null) {
                    i++;
                    continue;
                }

                if (writer == null) {
                    writer = new StringBuilder(input.length());
                }
                writer.append(input.substring(st, i - 1));

                writer.append(value);
            }

            // skip escape
            st = j + 1;
            i = st;
        }

        if (writer != null) {
            writer.append(input.substring(st, len));
            return writer.toString();
        }
        return input;
    }
5822
private void escape(String value) {
        int n = value.length();
        int i = 0;
        for (int j = 0; j < n; ++j) {
            int k = ESCAPED_CHARS.indexOf(value.charAt(j));
            if (k >= 0) {
                if (i < j) {
                    append(value, i, j);
                }
                append(ESCAPE_SEQ[k]);
                i = j + 1;
            }
        }
        if (i < n) {
            append(value, i, n);
        }
    }
382497
private static String escapeJavaScriptChars(String s) {
        StringBuilder sb = new StringBuilder();
        for (int i = 0; i < s.length(); i++) {
            char ch = s.charAt(i);
            switch (ch) {
                case '\b':
                    sb.append("\\b");
                    break;
                case '\t':
                    sb.append("\\t");
                    break;
                case '\n':
                    sb.append("\\n");
                    break;
                case '\f':
                    sb.append("\\f");
                    break;
                case '\r':
                    sb.append("\\r");
                    break;
                case '"':
                    sb.append("\\\"");
                    break;
                case '\'':
                    sb.append("\\\'");
                    break;
                case '\\':
                    sb.append("\\\\");
                    break;
                default:
                    if (ch < 32 || ch >= 127) {
                        sb.append(String.format("\\u%04X", (int)ch));
                    } else {
                        sb.append(ch);
                    }
                    break;
            }
        }
        return sb.toString();
    }
402366
def prettyhtml(value, autoescape=None):
	''
	value = html_cleaner(value)
	return escape(value) if autoescape\
		and not isinstance(value, SafeData) else mark_safe(value)
180419
function escapeCodeAsRegExpForMatchingInsideHTML(body) {
        return escapeRegExp(body).replace('<', '(?:<|&lt;)').replace('>', '(?:>|&gt;)').replace('&', '(?:&|&amp;)').replace('"', '(?:"|&quot;)').replace(/\s+/g, '\\s+');
    }
659959
function sanitizeTags(value, telegraf) {
  const blacklist = telegraf ? /:|\|/g : /:|\||@|,/g;
  // Replace reserved chars with underscores.
  return String(value).replace(blacklist, '_');
}
87269
function check(node) {
            const isTemplateElement = node.type === "TemplateElement";

            if (
                isTemplateElement &&
                node.parent &&
                node.parent.parent &&
                node.parent.parent.type === "TaggedTemplateExpression" &&
                node.parent === node.parent.parent.quasi
            ) {

                // Don't report tagged template literals, because the backslash character is accessible to the tag function.
                return;
            }

            if (typeof node.value === "string" || isTemplateElement) {

                /*
                 * JSXAttribute doesn't have any escape sequence: https://facebook.github.io/jsx/.
                 * In addition, backticks are not supported by JSX yet: https://github.com/facebook/jsx/issues/25.
                 */
                if (node.parent.type === "JSXAttribute" || node.parent.type === "JSXElement" || node.parent.type === "JSXFragment") {
                    return;
                }

                const value = isTemplateElement ? node.value.raw : node.raw.slice(1, -1);
                const pattern = /\\[^\d]/gu;
                let match;

                while ((match = pattern.exec(value))) {
                    validateString(node, match);
                }
            } else if (node.regex) {
                parseRegExp(node.regex.pattern)

                    /*
                     * The '-' character is a special case, because it's only valid to escape it if it's in a character
                     * class, and is not at either edge of the character class. To account for this, don't consider '-'
                     * characters to be valid in general, and filter out '-' characters that appear in the middle of a
                     * character class.
                     */
                    .filter(charInfo => !(charInfo.text === "-" && charInfo.inCharClass && !charInfo.startsCharClass && !charInfo.endsCharClass))

                    /*
                     * The '^' character is also a special case; it must always be escaped outside of character classes, but
                     * it only needs to be escaped in character classes if it's at the beginning of the character class. To
                     * account for this, consider it to be a valid escape character outside of character classes, and filter
                     * out '^' characters that appear at the start of a character class.
                     */
                    .filter(charInfo => !(charInfo.text === "^" && charInfo.startsCharClass))

                    // Filter out characters that aren't escaped.
                    .filter(charInfo => charInfo.escaped)

                    // Filter out characters that are valid to escape, based on their position in the regular expression.
                    .filter(charInfo => !(charInfo.inCharClass ? REGEX_GENERAL_ESCAPES : REGEX_NON_CHARCLASS_ESCAPES).has(charInfo.text))

                    // Report all the remaining characters.
                    .forEach(charInfo => report(node, charInfo.index, charInfo.text));
            }

        }