Lodash _.escape() Method

Beginner
5 min read
Updated: Nov 2026
5 examples
String
Decorative image with the word ESCAPE

Definition

Converts the characters &, <, >, ", and ' in a string to their corresponding HTML entities. Useful when you build HTML by string concatenation. Part of Lodash String (stable — not deprecated).

Pass the string and options shown below. Check the return type before you chain another helper.

Syntax

Call _.escape. Start with this line.

Lodash
_.escape([string=''])
CallWhat it does
_.escape([string=''])Primary signature.
_.escape(string)Transform or inspect a string.

Prefer import escape from "lodash/escape" when you want a smaller bundle.

Library declarations
Lodash
_.escape([string=''])

Parameters

ParameterDescription
stringOptional. Input to encode

Return Value

Return ValueDescription
*New string with entities

Lodash Examples

Example 1 — Official: Escape &

Encode an ampersand in a name list.

Lodash
_.escape('fred, barney, & pebbles');
// → 'fred, barney, &amp; pebbles'
Try It Yourself

How It Works

  1. Input. Contains a raw &.
  2. Replace. Lodash turns it into &amp;.
  3. Safe. In HTML, that displays as a literal &.
  4. Official. Same example as the Lodash docs.

Example 2 — Script-like markup as text

Angle brackets become entities so tags do not run.

Lodash
var raw = '<script>alert("hi")</script>';

_.escape(raw);
// → '&lt;script&gt;alert(&quot;hi&quot;)&lt;/script&gt;'
Try It Yourself

How It Works

  1. < / >. Become &lt; / &gt;.
  2. Quotes. Become &quot;.
  3. Display. Browser shows tags as text, not a script element.
  4. Layer. Still combine with CSP and safe DOM APIs.

Example 3 — Show an HTML snippet

Preview markup without the browser rendering it.

Lodash
var html = '<div>Hello, <strong>world</strong>!</div>';

_.escape(html);
// → '&lt;div&gt;Hello, &lt;strong&gt;world&lt;/strong&gt;!&lt;/div&gt;'
Try It Yourself

How It Works

  1. Goal. Show source, not bold text.
  2. escape. Encodes every < / >.
  3. Result. Safe string for an HTML preview panel.
  4. Tip. Prefer textContent when you control a DOM node.

Example 4 — Round-trip with _.unescape

Encode then decode the same five entities.

Lodash
var original = 'Tom & Jerry';
var encoded = _.escape(original);
var decoded = _.unescape(encoded);

encoded;
// → 'Tom &amp; Jerry'

decoded;
// → 'Tom & Jerry'
Try It Yourself

How It Works

  1. escape. & → &amp;.
  2. unescape. Reverses those five entities.
  3. Equal. decoded === original for this set.
  4. See. _.unescape.

Example 5 — vs _.escapeRegExp

HTML entities vs RegExp metacharacters.

Lodash
var input = 'a+b (test)';

_.escape(input);
// → 'a+b (test)'   // no HTML specials

_.escapeRegExp(input);
// → 'a\\+b \\(test\\)'
Try It Yourself

How It Works

  1. escape. Only HTML-significant characters change.
  2. escapeRegExp. Escapes +, (, ), etc.
  3. Pick. HTML output → escape; dynamic RegExp → escapeRegExp.
  4. See. _.escapeRegExp.
Compatibility

Browser & Runtime Support

_.escape is a Lodash 4.x String helper. It runs anywhere Lodash runs — modern browsers (CDN or bundle) and Node.js / Bun / Deno with npm install lodash or lodash/escape. Native alternative: assign with textContent, or use your framework’s auto-escaping.

✓ Stable · Lodash 4.x

_.escape()

Available in [email protected] and lodash/escape modular import. Works in evergreen browsers and current Node LTS when Lodash is installed.

100% With Lodash 4.x
Google Chrome Supported · Desktop & Mobile
Full support
Mozilla Firefox Supported · Desktop & Mobile
Full support
Apple Safari Supported · macOS & iOS
Full support
Microsoft Edge Supported · Chromium
Full support
Internet Explorer No native support · Use a polyfill
Polyfill
Opera Supported · Modern versions
Full support
Samsung Internet Supported · Android
Full support
Bun Supported · JavaScript runtime
Supported
Deno Supported · JavaScript runtime
Supported
Node.js Supported · Server runtime
Supported
Android WebView Supported · Modern WebView
Full support
_.escape Lodash 4.x

Bottom line: Safe for production. Escape on HTML output; store raw text when you can.

Frequently Asked Questions

_.escape([string='']) converts &, <, >, ", and ' to their HTML entities so the string shows as text, not markup. Official: _.escape('fred, barney, & pebbles') → 'fred, barney, &amp; pebbles'.
No. It is one layer for HTML text context. Also use CSP, framework escaping, validation, and safe APIs like textContent.
Only five: & → &amp;, < → &lt;, > → &gt;, " → &quot;, ' → &#39;.
_.escape targets HTML. _.escapeRegExp escapes RegExp metacharacters for safe new RegExp() patterns.
Yes — _.unescape() decodes those five entities back to characters.
Usually store raw text and escape on output. Escaping at storage time risks double-encoding and harder edits.

Next: _.escapeRegExp()

Escape special characters before building a RegExp from user text.

_.escapeRegExp() →

About the author

Mari Selvan M P
Mari Selvan M P 🔗

Developer, cloud engineer, and technical writer

  • Experience 12 years building web and cloud systems
  • Focus Full Stack Development, AWS, and Developer Education

I write practical tutorials so students and working developers can learn by doing—from databases and APIs to deployment on AWS.

AWS Certified Developer – Associate (Credly)

9 people found this page helpful

Lodash _.endsWith() Method — Check String Suffix Lodash _.escapeRegExp() Method — Escape Regex Specials