function escape(s) {
  function htmlEscape(s) {
    return s.replace(/./g, function(x) {
       return { ‘<‘: ‘&lt;‘, ‘>‘: ‘&gt;‘, ‘&‘: ‘&amp;‘, ‘"‘: ‘&quot;‘, "‘": ‘&#39;‘ }[x] || x;       
     });
  }

  function expandTemplate(template, args) {
    return template.replace(
        
 
/{(\w+)}/g, 
        function(_, n) { 
           return htmlEscape(args[n]);
         });
  }
  
  return expandTemplate(
    "                                                \n      <h2>Hello, <span id=name></span>!</h2>         \n      <script>                                       \n         var v = document.getElementById(‘name‘);    \n         v.innerHTML = ‘<a href=#>{name}</a>‘;       \n      <\/script>                                     \n    
 
",
    { name : s }
  );
}

嘗試：<img src=# onerror=alert(1)>

"<"、">" 被編碼。輸出後的內容，其上下文環境是 javascript ，js編碼即可，16進制、8進制或unicode。

alert(1) to win 9