HTML 编码器 / 解码器

import html

# Encode: replace <, >, &, ", ' with HTML entities
raw = "<script>alert('XSS')</script> & <b>bold</b>"

encoded = html.escape(raw)
print(encoded)
# &lt;script&gt;alert(&#x27;XSS&#x27;)&lt;/script&gt; &amp; &lt;b&gt;bold&lt;/b&gt;

# Also encode quotes (useful inside HTML attributes)
encoded_all = html.escape(raw, quote=True)
print(encoded_all)
# &lt;script&gt;alert(&#x27;XSS&#x27;)&lt;/script&gt; &amp; &lt;b&gt;bold&lt;/b&gt;

# Decode: convert HTML entities back to plain text
decoded = html.unescape(encoded)
print(decoded)
# <script>alert('XSS')</script> & <b>bold</b>

# Safe injection into a template
user_input = "<img src=x onerror=alert(1)>"
safe_html = f"<p>{html.escape(user_input)}</p>"