SafeHtmlUtils

An empty String.

Returns a SafeHtml constructed from a safe string, i.e., without escaping the string.

Important: For this method to be able to honor the SafeHtml contract, all uses of this method must satisfy the following constraints:

1. The argument expression must be fully determined at compile time.
2. The value of the argument must end in "inner HTML" context and not contain incomplete HTML tags. I.e., the following is not a correct use of this method, because the <a> tag is incomplete:

    shb.appendConstantHtml("<a href='").append(url)

The first constraint provides a sufficient condition that the argument (and any HTML markup contained in it) originates from a trusted source. The second constraint ensures the composability of SafeHtml values.

When executing client-side in Development Mode, or server side with assertions enabled, the argument is HTML-parsed and validated to satisfy the second constraint (the server-side check can also be enabled programmatically, see maybeCheckCompleteHtml(String) for details). For performance reasons, this check is not performed in Production Mode on the client, and with assertions disabled on the server.

Returns a SafeHtml containing the escaped string.

Returns a SafeHtml constructed from a trusted string, i.e., without escaping the string. No checks are performed. The calling code should be carefully reviewed to ensure the argument meets the SafeHtml contract.

HTML-escapes a string. Note: The following variants of this function were profiled on FF36, Chrome6, IE8: #1) for each case, check indexOf, then use s.replace(regex, string) #2) for each case, check indexOf, then use s.replaceAll() #3) check if any metachar is present using a regex, then use #1 #4) for each case, use s.replace(regex, string) #1 was found to be the fastest, and is used below.

HTML-escapes a string, but does not double-escape HTML-entities already present in the string.