WoYiGui's BloG | 关注安全测试

<script>
   function htmlspecialchars(string){
     var data = [];
     for(var i = 0 ;i <string.length;i++) {
       data.push( "&#"+string.charCodeAt(i)+";");
     }
  return data.join("");
   }
   document.write(htmlspecialchars("@{}<script>javascript alert<\/script>"));
</script>

<script>
function filter (str) {
  str = str.replace(/&/g, '&amp;');
  str = str.replace(/</g, '&lt;');
  str = str.replace(/>/g, '&gt;');
  str = str.replace(/'/g, '&acute;');
  str = str.replace(/"/g, '&quot;');
  str = str.replace(/\|/g, '&brvbar;');
  return str;
}
alert(filter("url"))
</script>