转义 html 标签属性值
我无法理解 javascript 的 html 标签属性值中的转义是如何工作的。
我被引导相信你应该总是逃跑& ' " < > 。因此，对于 javascript 作为属性值，我尝试过：
<a href="javascript:alert('Hello');"></a>
它不起作用。但是：
<a href="javascript:alert('Hello');"></a>
并且
<a href="javascript:alert('Hello');"></a>
在所有浏览器中都有效！
现在我完全困惑了。如果我所有的属性值都用双引号引起来，那么这意味着我不必转义单引号？还是 apos 和 ascii 39 在技术上是不同的字符？这样 javascript 需要 ascii 39，但不需要 apos？
I am having trouble understanding how escaping works inside html tag attribute values that are javascript.
I was lead to believe that you should always escape & ' " < > . So for javascript as an attribute value I tried:
<a href="javascript:alert('Hello');"></a>
It doesn't work. However:
<a href="javascript:alert('Hello');"></a>
and
<a href="javascript:alert('Hello');"></a>
does work in all browsers!
Now I am totally confused. If all my attribute values are enclosed in double quotes, does this mean I do not have to escape single quotes? Or is apos and ascii 39 technically different characters? Such that javascript requires ascii 39, but not apos?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
这里涉及两种类型的“转义”：HTML 和 JavaScript。解释 HTML 文档时，首先解析 HTML 转义符。
就 HTML 而言，属性值中的规则与其他地方相同，外加一条附加规则：
<应进行转义。通常使用<来实现此目的。从技术上讲，根据 HTML 版本，转义并不总是必需的，但它始终是一个很好的做法。&应该被转义。通常使用&来实现此目的。这也并不总是强制性的，但总是这样做比在需要时学习和记住更简单。"作为分隔符，则通常使用"来转义它的出现，而对于 Ascii 撇号，实体引用& ;apos;仅在某些 HTML 版本中定义，因此使用数字引用'（或'）。你如果您愿意，可以转义
>（或任何其他数据字符），但在 JavaScript 方面，有一些转义机制（使用
\）。但这些是一个不同的问题，与您的情况无关，在符合当前规范的浏览器上，JavaScript 解释器会看到完全相同的代码
alert('Hello');. 浏览器已“未转义”。'或'到'听到'我有点惊讶。 code> 目前尚未得到普遍支持，但这不是问题：很少需要在 HTML 中转义 Ascii 撇号（仅在属性值内需要转义，并且仅当您使用 Ascii 撇号作为分隔符时），如果有，您可以使用'参考。There are two types of “escapes” involved here, HTML and JavaScript. When interpreting an HTML document, the HTML escapes are parsed first.
As far as HTML is considered, the rules within an attribute value are the same as elsewhere plus one additional rule:
<should be escaped. Usually<is used for this. Technically, depending on HTML version, escaping is not always required, but it has always been good practice.&should be escaped. Usually&is used for this. This, too, is not always obligatory, but it is simpler to do it always than to learn and remember when it is required."as delimiter, it is customary to escape its occurrences using"whereas for the Ascii apostrophe, the entity reference'is defined in some HTML versions only, so it it safest to use the numeric reference'(or').You can escape
>(or any other data character) if you like, but it is never needed.On the JavaScript side, there are some escape mechanisms (with
\) in string literals. But these are a different issue, and not relevant in your case.In your example, on a browser that conforms to current specifications, the JavaScript interpreter sees exactly the same code
alert('Hello');. The browser has “unescaped”'or'to'. I was somewhat surprised to hear that'is not universally supported these days, but it’s not an issue: there is seldom any need to escape the Ascii apostrophe in HTML (escaping is only needed within attribute values and only if you use the Ascii apostrophe as its delimiter), and when there is, you can use the'reference.'不是有效的 HTML 参考实体< /a>.您应该使用'进行转义'is not a valid HTML reference entity. You should escape using'