XML-escape given string

annotated.js

function (s) {
    return s.replace(
        /[&<>'"]/g, // All characters we want to escape
        function (c){
            return "&" // prefix
                + { // lookup map
                      "&": "amp",
                      "<": "lt",
                      ">": "gt",
                      "'": "apos",
                      '"': "quot"
                  }[c]
                + ";" // suffix
        })
}

index.js

function(s){return s.replace(/[&<>'"]/g,function(c){return "&"+{"&":"amp","<":"lt",">":"gt","'":"apos",'"':"quot"}[c]+";"})}

LICENSE.txt

            DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE
                    Version 2, December 2004

 Copyright (C) 2011 Ates Goral <http://magnetiq.com>

 Everyone is permitted to copy and distribute verbatim or modified
 copies of this license document, and changing it is allowed as long
 as the name is changed.

            DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE
   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION

  0. You just DO WHAT THE FUCK YOU WANT TO.

package.json

{
  "name": "xmlEscape",
  "description": "Escape basic XML characters",
  "keywords": [
    "string",
    "escaping",
    "xml" 
  ]
}

test.js

var xmlEscape = function(s){return s.replace(/[&<>'"]/g,function(c){return "&"+{"&":"amp","<":"lt",">":"gt","'":"apos",'"':"quot"}[c]+";"})};

console.log(xmlEscape("testing <element attribute=\"value\"> & apostrophe (')"));
// testing &lt;element attribute=&quot;value&quot;&gt; &amp; apostrophe (&apos;)

You can leave out the brackets in the regexp - the first callback parameter is always the full match.

Regards, LX

@atx: Must be a vestige of a prior implementation. Shaved two more bytes. Thanks!

" is a shorter way of saying ", and % is a shorter way of saying '.

// original: 124 bytes
function(s){return s.replace(/[&<>'"]/g,function(c){return "&"+{"&":"amp","<":"lt",">":"gt","'":"apos",'"':"quot"}[c]+";"})}
// 122 bytes
function(s){return s.replace(/[&<>'"]/g,function(c){return "&"+{"&":"amp","<":"lt",">":"gt","'":"#37",'"':"#34"}[c]+";"})}

Also, if IE < 9 support is not an issue, this could be shortened even more by using the new Option(html).innerHTML trick to escape HTML.

// 87 bytes, but doesn’t work in IE < 9
function(s){return new Option(s).innerHTML.replace(/"/g,'&#34;').replace(/'/g,'&#37;')}

Even shorter:

// 56 bytes
function(s){return new Audio(s).outerHTML.slice(27,-10)}

@eligrey: Wow! Hax!

Same char len (56), a different take:

function(s){return new Audio(s).outerHTML.split('"')[3]}

@atesgoral and @eligrey, those last two versions don’t escape single quotes though, so you’d still need .replace(/'/g,'%').

// 78 bytes, but doesn’t work in IE < 9
function(s){return new Audio(s).outerHTML.slice(27,-10).replace(/'/g,'&#37;')}

While Option is available even in IE6, Audio is not even present in IE8.

@atk

While Option is available even in IE6 […]

It is available in IE6 but it doesn’t work the way it’s being used here.

I win, 39 byte

s=>new Audio(s).outerHTML.slice(27,-10)

@jimmywarting ES6 FTW!