[HTML] Escape character character entity <; >: &;

In the development, the url obtained by javascript from the background will be escaped, such as: http://localhost:8080/Home/Index?a=14&b=15&c=123, I want to convert it to http:/ /localhost:8080/Home/Index?a=14&b=15&c=123

I found a solution for a long time online:

Escaping is divided into escapeHTML and unescapeHTML, let's look at the realization of the two functions first.

js code:

/**
 * @function escapeHTML 转义html脚本 < > & " '
 * @param a -
 *            字符串
 */
escapeHTML: function(a){
    a = "" + a;
    return a.replace(/&/g, "&").replace(/</g, "<").replace(/>/g, ">").replace(/"/g, """).replace(/'/g, "&apos;");;
},
/**
 * @function unescapeHTML 还原html脚本 < > & " '
 * @param a -
 *            字符串
 */
unescapeHTML: function(a){
    a = "" + a;
    return a.replace(/</g, "<").replace(/>/g, ">").replace(/&/g, "&").replace(/"/g, '"').replace(/&apos;/g, "'");
},

1. EscapeHTML converts <> & "'into character entity 
usage scenarios: 
(1) The user enters in the page (such as an input box) <script>alert(2);</script>, js submits the content to the backend save 
(2) shows that the rear end of the string is returned distal end; after js received: 
A, using escapeHTML, will be converted to a string & lt; script & gt; alert (2); & lt; / script & gt; In this case, the browser It can be parsed correctly, because after the browser receives the entity characters, it turns into the corresponding angle brackets, etc. 
b. Without using escapeHTML, the browser thinks it is the beginning of the html tag when it sees <, and directly uses the string just now as a script Execution, this is the xss vulnerability. 

2. unescapeHTML converts character entities into <> & "' 
Usage scenario: The 
backend displays the escaped content to the page; for example, <script>alert(2);</ After script> 
js is received: 
a. If the front end performs unescapeHTML, you can directly operate the dom to display the label on the page. 
b. If there is no unescapeHTML on the front end, it will output <script>alert(2);</script> as it is, but it is not executed at this time. 

Escape character: 

Tip: The advantage of using physical names instead of numbers is that the names are easy to remember. But the disadvantage is that the browser may not support all entity names (the support for entity numbers is good).