java 为什么 '<' 显示为 <
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/981852/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
why is '<' showing as <
提问by Ryan Oberoi
I am outputting a string form my java class like this
我正在像这样从我的 java 类中输出一个字符串
String numQsAdded = "<div id='message1'>"+getQuestion()+"</div>";
This string is being sent back to the client side as a XMLHttpRequest. So, in my jsp page I have a javascript alert method that prints out the string returned from the server. it translates '<' to <and '>' to >
该字符串作为 XMLHttpRequest 被发送回客户端。因此，在我的 jsp 页面中，我有一个 javascript 警报方法，可以打印出从服务器返回的字符串。它将“<”<和“>”翻译成>
how can i avoid this?
我怎样才能避免这种情况？
I have tried changing my string to:
我尝试将字符串更改为：
String numQsAdded = "<div id='message1'>"+getQuestion()+">/div<";
but this has even worse effects. then '&' is translated as 'amp'
但这有更糟糕的影响。然后'&'被翻译成'amp'
回答by Ryan Oberoi
XMLHttpRequest encodes the string before sending it. You will have to unescape the string. on the client side javascript, try using:
XMLHttpRequest 在发送之前对字符串进行编码。您将不得不对字符串进行转义。在客户端javascript，尝试使用：
alert(unescape(returned_string))
回答by KM.
<is the way to show "<" in html, which is produced from XMLHttpRequest. try using XMLRequest
<是在 html 中显示“<”的方式，它是从 XMLHttpRequest 生成的。尝试使用 XMLRequest
回答by Matthew Vines
It is the entity reference for "<" while > ; is the entity reference for ">" you will need to unescape the string using the unescape() method
它是“<”而 > 的实体引用。是 ">" 的实体引用，您需要使用 unescape() 方法取消转义字符串
回答by Joe Davis
Paul Fisher's answer is the right one. I'll take a moment to explain why. HTML-Encoding of content from the server is a security measure to protect your users from script injection attacks. If you simply unescape() what comes from the server you could be putting your users at risk, as well as your site's reputation.
保罗·费舍尔的回答是正确的。我会花点时间解释原因。来自服务器的内容的 HTML 编码是一种安全措施，可保护您的用户免受脚本注入攻击。如果您只是 unescape() 来自服务器的内容，您可能会将您的用户置于危险之中，以及您网站的声誉。
Try doing what Paul said. It's not difficult and it's much more secure. Just to make it easier, here's a sample:
试着照保罗说的去做。这并不困难，而且更安全。为了方便起见，这里有一个示例：
var divStuff = document.createElement('div');
divStuff.appendChild(containerElement);
divStuff.id = 'message1';
divStuff.innerHTML = getQuestion();
This is much more secure and draws a better separation for you presentation layer in your application.
这更加安全，并且为您的应用程序中的表示层绘制了更好的分离。
回答by Paul Fisher
It might be better to send back a raw string with your message, and leave the client Javascript to create a divwith class message1to put it in. This will also help if you ever decide to change the layout or the style of your notices.
最好将原始字符串与您的消息一起发回，并让客户端 Javascript 创建一个divwith 类message1来放入它。如果您决定更改通知的布局或样式，这也将有所帮助。
回答by paradisontheitroad
I don't think you can avoid that. It's how "<" is represented in HTML, and the result would be OK on your HTML page.
我认为你无法避免这种情况。这就是“<”在 HTML 中的表示方式，结果在您的 HTML 页面上就可以了。
