转义未引用的属性

Question

With quoted attributes, I already know the solution.

function encodeForHTML(str){
    return str
        .replace(/&/g, '&')
        .replace(/"/g, '"')
        .replace(/'/g, ''')
        .replace(/</g, '&lt;')
        .replace(/>/g, '&gt;')
        .replace(/\//g, '&#x2F;');
}

How about unquoted one? Which characters must be escaped beside those 6 characters? And how can I implement it in JS?

Answer 1

According to the W3 HTML spec , the characters not allowed in unquoted attribute values are """, "'", "=", ">", "<", or "`" and the literal space character. (Oh, and the attribute value cannot be the empty string, either.)

I think the only additions to what you already have are the equal sign, back-quote, and space. Note that you can also eliminate the forward slash ("/") from your list; it doesn't need encoding.