http://qmc.yohops.com/onlinebug/detail?id=641 xss攻击

@@ -141,11 +141,11 @@ function getDetailInfo(id){
          dataType: 'json',
          success: function (result) {
              if(result.code == 200) {
-            	 $("#brandValue").html(result.data.brand);
-            	 $("#productNameValue").html(result.data.productName);
+            	 $("#brandValue").html(result.data.brand.replace(/</ig, '&lt;').replace(/>/ig, '&gt;'));
+            	 $("#productNameValue").html(result.data.productName.replace(/</ig, '&lt;').replace(/>/ig, '&gt;'));
             	 $("#priceValue").html(result.data.price);
             	 $("#saleTimeValue").html(result.data.saleTime);
-            	 $("#productCodeValue").html(result.data.productCode);
+            	 $("#productCodeValue").html(result.data.productCode.replace(/</ig, '&lt;').replace(/>/ig, '&gt;'));
             	 var imageStr = "";
             	 for (var i=0;i<result.data.imageList.length;i++){
             		 imageStr += "<img height='132px;' width='211px;' class='pimg' src='"+result.data.imageList[i]+"'/>";

@@ -100,12 +100,18 @@ function loadMainList(){
             title: "品牌*",
             field: "brand",
             width: 20,
-            align: "center"
+            align: "center",
+            formatter: function (value, rowData, rowIndex) {
+                return value.replace(/</ig, '&lt;').replace(/>/ig, '&gt;');
+            }
         }, {
             title: "商品名称*",
             field: "productName",
             width: 20,
-            align: "center"
+            align: "center",
+            formatter: function (value, rowData, rowIndex) {
+                return value.replace(/</ig, '&lt;').replace(/>/ig, '&gt;');
+            }
         }, {
             title: "发售价",
             field: "price",
@@ -120,7 +126,10 @@ function loadMainList(){
             title: "货号*",
             field: "productCode",
             width: 20,
-            align: "center"
+            align: "center",
+            formatter: function (value, rowData, rowIndex) {
+                return value.replace(/</ig, '&lt;').replace(/>/ig, '&gt;');
+            }
         }, {
             title: "创建时间",
             field: "createTimeStr",

@@ -106,11 +106,11 @@ function getDetailInfo(id){
          dataType: 'json',
          success: function (result) {
              if(result.code == 200) {
-            	 $("#brandValue").html(result.data.brand);
-            	 $("#productNameValue").html(result.data.productName);
+            	 $("#brandValue").html(result.data.brand.replace(/</ig, '&lt;').replace(/>/ig, '&gt;'));
+            	 $("#productNameValue").html(result.data.productName.replace(/</ig, '&lt;').replace(/>/ig, '&gt;'));
             	 $("#priceValue").html(result.data.price);
             	 $("#saleTimeValue").html(result.data.saleTime);
-            	 $("#productCodeValue").html(result.data.productCode);
+            	 $("#productCodeValue").html(result.data.productCode.replace(/</ig, '&lt;').replace(/>/ig, '&gt;'));
             	 var imageStr = "";
             	 for (var i=0;i<result.data.imageList.length;i++){
             		 imageStr += "<img height='132px;' width='211px;' class='pimg' src='"+result.data.imageList[i]+"'/>";