过滤用户输入恶意代码

let userInput = filterHTML('\<script\>alert("abc")\</script\>'); // 恶意代码

function filterHTML(string) {
    let s = '';
    for (let i = 0; i < string.length; i++) {
        let arg = string[i];
        s += arg.replace(/&/g, "&amp;")
            .replace(/</g, "&lt;")
            .replace(/>/g, "&gt;");
    }
    return s;
}
document.write(userInput);