//! HTML escaping utilities.

/// Escape HTML special characters to prevent XSS attacks.
///
/// This function escapes the following characters:
/// - `&` → `&amp;`
/// - `<` → `&lt;`
/// - `>` → `&gt;`
/// - `"` → `&quot;`
/// - `'` → `&#x27;`
///
/// # Example
///
/// ```
/// use soot_core::html::escape_html;
///
/// assert_eq!(escape_html("<script>"), "&lt;script&gt;");
/// ```
#[must_use]
pub fn escape_html(input: &str) -> String {
    let mut output = String::with_capacity(input.len());
    for c in input.chars() {
        match c {
            '&' => output.push_str("&amp;"),
            '<' => output.push_str("&lt;"),
            '>' => output.push_str("&gt;"),
            '"' => output.push_str("&quot;"),
            '\'' => output.push_str("&#x27;"),
            _ => output.push(c),
        }
    }
    output
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn test_escape_html() {
        assert_eq!(escape_html("Hello"), "Hello");
        assert_eq!(escape_html("<script>"), "&lt;script&gt;");
        assert_eq!(escape_html("a & b"), "a &amp; b");
        assert_eq!(escape_html("\"quoted\""), "&quot;quoted&quot;");
        assert_eq!(escape_html("it's"), "it&#x27;s");
    }

    #[test]
    fn test_escape_html_combined() {
        assert_eq!(
            escape_html("<a href=\"test\">Link & 'stuff'</a>"),
            "&lt;a href=&quot;test&quot;&gt;Link &amp; &#x27;stuff&#x27;&lt;/a&gt;"
        );
    }
}
