Function escape_attribute 

pub fn escape_attribute(input: &str) -> Cow<'_, str>

Escapes a value for use inside a double-quoted HTML attribute.

Deliberately narrower than escape_text: < and > are left alone, because they cannot terminate a quoted attribute value, and marketing-pretty.html contains attribute values that prove it.

That holds wherever the parser reads attributes. Under a raw-text ancestor (noscript, iframe, xmp, script, style, …) it does not, so the renderer escapes < and > itself there — this function cannot, because it never sees the ancestors. See SECURITY.md.

Examples

use molt::core::escape::escape_attribute;
assert_eq!(escape_attribute(r#"a "b" & <c>"#), "a &quot;b&quot; &amp; <c>");