thtml-escape Dependency of thtmlx for (un)escaping HTML. from thtml_escape import encode, decode print(encode('" onmouseover="alert(1)')) # " onmouseover="alert(1) print(decode('" onmouseover="alert(1)'))