Approach XSS prevention on Html page using javascript

Question

如何使用javascript（而非jsp页面）转义表单的文本框内容以避免xss。提交表单时，必须在页面上正确地重新放置它。

Answer 1

使用document.appendChild ， document.createTextNode和friends而不是接受原始HTML的属性（例如innerHTML ）将文本插入文档中。

Answer 2

"Insert the text into the document using document.appendChild, document.createTextNode and friends instead of a property (such as innerHTML) that accepts raw HTML."

as Quentin says, or, using an existing textbox, use the value property:

textObject.value="value"