Returns

{String}:

the string safely HTML-escaped

var string = require("can-string");

string.esc("<div>&nbsp;</div>"); //-> "&lt;div&gt;&amp;nbsp;&lt;/div&gt;"