js html代码转译防xss攻击

function safeHtml(a){//转译html代码    var s="";    for(var i=0;i<a.length;i++){        var arg=String(a);        s=arg.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;");        console.log(s);    }    return s;}window.onload=function(){    var txt=document.getElementById("txt");    var btn=document.getElementById("btn");    btn.onclick=function(){        var ss=txt.value;        var xx=safeHtml(ss);        var div = document.getElementById('div');        div.innerHTML=xx;    }}