The translated webpage displays &—was it decoded one extra time?

This paper uses synthetic samples to demonstrate the processing method. The code has been verified using examples in an isolated environment; this does not guarantee effectiveness for all real files or products. Before processing important files, please retain the original copies and verify them against the boundaries and acceptance criteria specified in the text. The page displays a string of &amp; , the first reaction is often to decode it once more. But the problem may be just the opposite: the same piece of content has already been escaped, and then escaped again by the template. First determine whether what you’ve got is raw HTML, DOM text, or a plain string ready to be inserted into the page, and then decide whether or not to perform any further conversion. escaping is a matter of output boundaries html.escape converts characters in plain text that have HTML meanings into entities; html.unescape parses entities. They are not “cleaning steps” that can be invoked interchangeably at will. What the translator typically requires is semantic text, whereas what the template needs is a serialized result that conforms to the rules of the current context. for example, the product name R&D When displayed as text, there is no problem; when written into HTML source code, it is usually represented as R&amp;D . A second escape will turn it into R&amp;amp;D , the browser displays the intermediate literal entity. Conversely, decoding untrusted content and inserting it directly as HTML may re-activate its embedded tags. conducts a small experiment using three states import html plain = 'R&D <Guide> "2026"' encoded = html.escape(plain, quote=True) double_encoded = html.escape(encoded, quote=True) assert encoded == 'R&amp;D &lt;Guide&gt; &quot;2026&quot;' assert html.unescape(encoded) == plain assert html.unescape(double_encoded) == encoded assert html.unescape(double_encoded) != plain untrusted = '&lt;img src=x onerror=alert(1)&gt;' decoded = html.unescape(untrusted) safe_as_text = html.escape(decoded, quote=True) assert decoded.startswith('<img') assert safe_as_text.startswith('&lt;img') This is a synthesis transformation example from the standard library; it does not execute HTML or scripts. The last two lines describe processing “as text output,” which is neither a secure HTML sanitization scheme nor sufficient to ensure that any arbitrary result can be safely embedded in JavaScript, CSS, or URLs. Different contexts require different rules. names the data state within the pipeline can be used with source_html 、 plain_text 、 translated_text and rendered_html Distinguish the stages, avoiding calling several types all by the same name. content . If the project permits, you can also wrap it in a lightweight data class to explicitly specify which function accepts only plain text. Naming cannot replace testing, but it can help reviewers detect wiring errors such as “passing the final HTML back to the translator.” current input What do you hope to get? should first confirm Original HTML translatable text uses a parser to locate the text node DOM text Target language text is generally not to be decoded unconditionally again as Translated plain text page-visible text causes the template to perform text escaping Allowed rich text Secure Display Fragment employs a well-defined cleaning strategy should not be decoded iteratively until “no longer changes” This approach appears to be able to handle multi-level entities, but in reality it will ruin the code that the user originally intended to display. The tutorial explains that &lt;div&gt; might be a deliberately retained literal, rather than a tag that was inadvertently left unprocessed. Whether to parse it one level deeper should be determined by the input protocol, not by guessing based on the string’s appearance. Links, attribute values, and code blocks in the main text may also follow different translation policies. Retaining a set of regression samples containing angle brackets, quotation marks, ampersands, and entity literals, and examining both the parsed text and the final browser display, is more useful than simply comparing the source file strings. translation acceptance should retain this small-sample evaluation OmniDoc (Product Entry) When waiting for the document translation entry point, you can place such samples into an HTML test file to check whether the tag examples and product names in the translated text still appear as expected. Do not consider “the English has been translated” as the sole criterion for completion: content meaning, the number of escape layers, and code protection are all part of the deliverable. Reference: Python html module 。 - 1 -