当前位置:网站首页>使用标签模板解决用户恶意输入的问题
使用标签模板解决用户恶意输入的问题
2022-07-06 08:53:00 【InfoQ】
什么是恶意输入
<script>
alert("猪痞恶霸yyds")
</script>
alert
标签模板
概念
let str = "猪痞恶霸",
_str = "fzf404";
function add(a, ...b) {
console.log(a);
console.log(b);
}
add`Hello${str}World${_str}`;
// [ 'Hello', 'World', '' ]
// [ '猪痞恶霸', 'fzf404' ]
[ 'Hello', 'World', '' ]
_str
"World"
[ '猪痞恶霸', 'fzf404' ]
使用
str
let str = "<script>alert("猪痞恶霸yyds")</script>"
arguments
String()
replace
<
>
<script>
function SaferHTML(tempalte) {
let s = tempalte[0];
for (let i = 1; i < arguments.length; i++) {
let arg = String(arguments[i]);
// Escape special characters in the substitution.
s += arg.replace(/&/g, "&")
.replace(/</g, "<")
.replace(/>/g, ">");
// Don't escape special characters in the template.
s += tempalte[i];
}
return s;
}
let end = SaferHTML`<p>${str}用户输入${str}</p>`;
参考文献
边栏推荐
- Marathon envs project environment configuration (strengthen learning and imitate reference actions)
- Indentation of tabs and spaces when writing programs for sublime text
- Detailed explanation of dynamic planning
- LeetCode:236. The nearest common ancestor of binary tree
- LeetCode:221. 最大正方形
- opencv+dlib实现给蒙娜丽莎“配”眼镜
- 有效提高软件产品质量,就找第三方软件测评机构
- Unsupported operation exception
- Promise 在uniapp的简单使用
- Chapter 1 :Application of Artificial intelligence in Drug Design:Opportunity and Challenges
猜你喜欢
The harm of game unpacking and the importance of resource encryption
UML图记忆技巧
Nacos 的安装与服务的注册
TP-LINK 企业路由器 PPTP 配置
ROS compilation calls the third-party dynamic library (xxx.so)
[MySQL] limit implements paging
Detailed explanation of dynamic planning
MongoDB 的安装和基本操作
Simple use of promise in uniapp
ant-design的走马灯(Carousel)组件在TS(typescript)环境中调用prev以及next方法
随机推荐
Generator parameters incoming parameters
Delay initialization and sealing classes
poi追加写EXCEL文件
R language uses the principal function of psych package to perform principal component analysis on the specified data set. PCA performs data dimensionality reduction (input as correlation matrix), cus
Current situation and trend of character animation
MySQL uninstallation and installation methods
LeetCode:162. 寻找峰值
【剑指offer】序列化二叉树
Export IEEE document format using latex
The network model established by torch is displayed by torch viz
TP-LINK enterprise router PPTP configuration
Crash problem of Chrome browser
广州推进儿童友好城市建设,将探索学校周边200米设安全区域
Chapter 1 :Application of Artificial intelligence in Drug Design:Opportunity and Challenges
What are the common processes of software stress testing? Professional software test reports issued by companies to share
Image, CV2 read the conversion and size resize change of numpy array of pictures
LeetCode:394. String decoding
Revit secondary development Hof method calls transaction
What is an R-value reference and what is the difference between it and an l-value?
[OC-Foundation框架]---【集合数组】