jQuery 的html()函数自动把不安全的标签<script>标签和&符号escape了
script标签被转换成 & lt;script& gt;alert("test");& lt;/script& gt; , 避免Cross-site scripting 攻击
&符号被转换成 & amp;
是否还有其他标签或特殊字符被转换？试了一下没发现，也没找到对应的文档说明
而text()、append()函数不做任何改变，无法阻止Cross-site scripting 攻击
Actually both do look somewhat similar but are quite different it depends on your usage or intention what you want to achieve ,Where to use:
use.html()to operate on containers having html elements.
use.text()to modify text of elements usually having separate open and closing tags
Where not to use:
.text()method cannot be used on form inputs or scripts.
.val()for input or textarea elements.
.html()for value of a script element.
Picking up html content from.text()will convert the html tags into html entities.
Difference:
.text()can be used in both XML and HTML documents.
.html()is only for html documents.
Check this example on jsfiddle to see the differences in action
