禁用节点中不需要的xss保护

Question

我从未安装过任何xss保护或类似的东西。我意识到我在使用头盔，但输出也在没有头盔的情况下受到保护。

带头盔的数据库输入：

""<p>\"&lt;p&gt;sdfsdf&lt;strong&gt;sdfsdf&lt;/strong&gt;f&lt;/p&gt;\"</p>""

无头盔的数据库输入

""<p>fsdfds<strong>fsdfsd<em>fdsfsdfs</em></strong></p>""

但网站上没有头盔的输出仍然存在。

"<p>fsdfds<strong>fsdfsd<em>fdsfsdfs</em></strong></p>"

我该怎么做才能显示正确的格式而不是标记？

添加物品控制器

const Article = require("../models/article")
exports.articleAdd = function (req, res) {
var heading = req.body.heading;
var author = req.user.firstname;
var body = req.body.body;
var slug = req.body.slug;
var thumbnail = "/uploads/thumbnails/" + req.body.slug + ".jpg";
// Validation
req.checkBody("heading", "heading is required").notEmpty();
req.checkBody("body", "body is required").notEmpty();
req.checkBody("slug", "slug is not valid").notEmpty();
var errors = req.validationErrors();
if (errors) {
res.render("../core/modules/articles/views/addArticles", {
errors: errors,
layout: 'cmsLayout',
heading: heading,
author: author,
body: body,
slug: slug
});
} else {
let article = new Article({
heading: heading,
author: author,
body: body,
slug: slug,
thumbnail: "/uploads/thumbnails/" + req.body.slug + ".jpg"
});
article.save(function (err) {
if (err) {
console.log(err);
return;
} else {
res.redirect('/');
}
});
}
}

Answer 1

对不起，可能是我的错误，我没有说我正在使用HANDLEBARS。这实际上是个问题。要像html一样输出它，我需要使用{{{something}}}而不是{{something}}