const userInput = "<script>alert('xss')</script>";
const sanitized = userInput
  .replace(/</g, '&lt;')
  .replace(/>/g, '&gt;')
  .replace(/"/g, '&quot;')
  .replace(/'/g, '&#x27;');

const credentials = {
  username: 'admin',
  password: 'secret123'
};

const safeLog = (obj) => {
  const { password, ...safe } = obj;
  return JSON.stringify(safe);
};

console.log(sanitized);
console.log(safeLog(credentials));