<script>alert("xss");</script>
被转换成了
<script>alert("xss");</script>