If you just want to escape unsafe characters, just escaping `&`, `<`, `"`, `'`, and possibly `>` and ````` (if you want to support unquoted attribute values) is enough for HTML contexts. This is what [`_.escape`](http://lodash.com/docs#escape) and [`he.escape()`](https://github.com/mathiasbynens/he#heescapetext) do, btw.

If you want to encode all non-ASCII symbols as well, use something like [`he.encode()`](https://github.com/mathiasbynens/he#heencodetext-options).

What you’re doing now seems like something in between. What is the goal exactly?