diff --git a/applications/common/admin_log.py b/applications/common/admin_log.py
index 24a4373..90125ad 100644
--- a/applications/common/admin_log.py
+++ b/applications/common/admin_log.py
@@ -1,6 +1,6 @@
 from flask_login import current_user
 
-from applications.common.utils.validate import xss_escape
+from applications.common.utils.validate import str_escape
 from applications.extensions import db
 from applications.models import AdminLog
 
@@ -10,8 +10,8 @@ def login_log(request, uid, is_access):
         'method': request.method,
         'url': request.path,
         'ip': request.remote_addr,
-        'user_agent': xss_escape(request.headers.get('User-Agent')),
-        'desc': xss_escape(request.form.get('username')),
+        'user_agent': str_escape(request.headers.get('User-Agent')),
+        'desc': str_escape(request.form.get('username')),
         'uid': uid,
         'success': int(is_access)
 
@@ -36,8 +36,8 @@ def admin_log(request, is_access):
         'method': request.method,
         'url': request.path,
         'ip': request.remote_addr,
-        'user_agent': xss_escape(request.headers.get('User-Agent')),
-        'desc': xss_escape(str(dict(request.values))),
+        'user_agent': str_escape(request.headers.get('User-Agent')),
+        'desc': str_escape(str(dict(request.values))),
         'uid': current_user.id,
         'success': int(is_access)
 
diff --git a/applications/common/utils/validate.py b/applications/common/utils/validate.py
index 2921f8c..05b8011 100644
--- a/applications/common/utils/validate.py
+++ b/applications/common/utils/validate.py
@@ -1,13 +1,11 @@
 # xss过滤
-from flask import abort, make_response, jsonify
+from flask import abort, make_response, jsonify, escape
 
 
-def xss_escape(s: str):
-    if s is None:
+def str_escape(s):
+    if not s:
         return None
-    else:
-        return s.replace("&", "&amp;").replace(">", "&gt;").replace("<", "&lt;").replace("'", "&#39;").replace('"',
-                                                                                                               "&#34;")
+    return str(escape(s))
 
 
 def check_data(schema, data):
diff --git a/applications/view/admin/admin_log.py b/applications/view/admin/admin_log.py
index 8dd1040..80ba1a6 100644
--- a/applications/view/admin/admin_log.py
+++ b/applications/view/admin/admin_log.py
@@ -13,6 +13,8 @@ admin_log = Blueprint('adminLog', __name__, url_prefix='/admin/log')
 @admin_log.get('/')
 @authorize("admin:log:main")
 def index():
+    from markupsafe import escape
+    escape
     return render_template('admin/admin_log/main.html')
 
 
diff --git a/applications/view/admin/dict.py b/applications/view/admin/dict.py
index 925805a..9818590 100644
--- a/applications/view/admin/dict.py
+++ b/applications/view/admin/dict.py
@@ -4,7 +4,7 @@ from applications.common import curd
 from applications.common.helper import ModelFilter
 from applications.common.utils.http import table_api, success_api, fail_api
 from applications.common.utils.rights import authorize
-from applications.common.utils.validate import xss_escape
+from applications.common.utils.validate import str_escape
 from applications.extensions import db
 from applications.models import DictType, DictData
 from applications.schemas import DictTypeOutSchema, DictDataOutSchema
@@ -23,7 +23,7 @@ def main():
 @authorize("admin:dict:main", log=True)
 def dict_type_data():
     # 获取请求参数
-    type_name = xss_escape(request.args.get('typeName', type=str))
+    type_name = str_escape(request.args.get('typeName', type=str))
     # 查询参数构造
     mf = ModelFilter()
     if type_name:
@@ -46,10 +46,10 @@ def dict_type_add():
 @authorize("admin:dict:add", log=True)
 def dict_type_save():
     req_json = request.json
-    description = xss_escape(req_json.get("description"))
-    enable = xss_escape(req_json.get("enable"))
-    type_code = xss_escape(req_json.get("typeCode"))
-    type_name = xss_escape(req_json.get("typeName"))
+    description = str_escape(req_json.get("description"))
+    enable = str_escape(req_json.get("enable"))
+    type_code = str_escape(req_json.get("typeCode"))
+    type_name = str_escape(req_json.get("typeName"))
     d = DictType(type_name=type_name, type_code=type_code, enable=enable, description=description)
     db.session.add(d)
     db.session.commit()
@@ -72,11 +72,11 @@ def dict_type_edit():
 @authorize("admin:dict:edit", log=True)
 def dict_type_update():
     req_json = request.json
-    id = xss_escape(req_json.get("id"))
-    description = xss_escape(req_json.get("description"))
-    enable = xss_escape(req_json.get("enable"))
-    type_code = xss_escape(req_json.get("typeCode"))
-    type_name = xss_escape(req_json.get("typeName"))
+    id = str_escape(req_json.get("id"))
+    description = str_escape(req_json.get("description"))
+    enable = str_escape(req_json.get("enable"))
+    type_code = str_escape(req_json.get("typeCode"))
+    type_name = str_escape(req_json.get("typeName"))
     DictType.query.filter_by(id=id).update({
         "description": description,
         "enable": enable,
@@ -126,7 +126,7 @@ def dict_type_delete(_id):
 @admin_dict.get('/dictData/data')
 @authorize("admin:dict:main", log=True)
 def dict_code_data():
-    type_code = xss_escape(request.args.get('typeCode', type=str))
+    type_code = str_escape(request.args.get('typeCode', type=str))
     dict_data = DictData.query.filter_by(type_code=type_code).layui_paginate()
     count = dict_data.total
     data = curd.model_to_dicts(schema=DictDataOutSchema, data=dict_data.items)
@@ -146,11 +146,11 @@ def dict_data_add():
 @authorize("admin:dict:add", log=True)
 def dict_data_save():
     req_json = request.json
-    data_label = xss_escape(req_json.get("dataLabel"))
-    data_value = xss_escape(req_json.get("dataValue"))
-    enable = xss_escape(req_json.get("enable"))
-    remark = xss_escape(req_json.get("remark"))
-    type_code = xss_escape(req_json.get("typeCode"))
+    data_label = str_escape(req_json.get("dataLabel"))
+    data_value = str_escape(req_json.get("dataValue"))
+    enable = str_escape(req_json.get("enable"))
+    remark = str_escape(req_json.get("remark"))
+    type_code = str_escape(req_json.get("typeCode"))
     d = DictData(data_label=data_label, data_value=data_value, enable=enable, remark=remark, type_code=type_code)
     db.session.add(d)
     db.session.commit()
@@ -175,11 +175,11 @@ def dict_data_update():
     req_json = request.json
     id = req_json.get("dataId")
     DictData.query.filter_by(id=id).update({
-        "data_label": xss_escape(req_json.get("dataLabel")),
-        "data_value": xss_escape(req_json.get("dataValue")),
-        "enable": xss_escape(req_json.get("enable")),
-        "remark": xss_escape(req_json.get("remark")),
-        "type_code": xss_escape(req_json.get("typeCode"))
+        "data_label": str_escape(req_json.get("dataLabel")),
+        "data_value": str_escape(req_json.get("dataValue")),
+        "enable": str_escape(req_json.get("enable")),
+        "remark": str_escape(req_json.get("remark")),
+        "type_code": str_escape(req_json.get("typeCode"))
     })
     db.session.commit()
     return success_api(msg="更新成功")
diff --git a/applications/view/admin/power.py b/applications/view/admin/power.py
index 1c58969..54de902 100644
--- a/applications/view/admin/power.py
+++ b/applications/view/admin/power.py
@@ -3,7 +3,7 @@ from flask import Blueprint, render_template, request, jsonify
 from applications.common import curd
 from applications.common.utils.http import success_api, fail_api
 from applications.common.utils.rights import authorize
-from applications.common.utils.validate import xss_escape
+from applications.common.utils.validate import str_escape
 from applications.extensions import db
 from applications.models import Power
 from applications.schemas import PowerOutSchema2
@@ -52,14 +52,14 @@ def select_parent():
 @authorize("admin:power:add", log=True)
 def save():
     req = request.json
-    icon = xss_escape(req.get("icon"))
-    openType = xss_escape(req.get("openType"))
-    parentId = xss_escape(req.get("parentId"))
-    powerCode = xss_escape(req.get("powerCode"))
-    powerName = xss_escape(req.get("powerName"))
-    powerType = xss_escape(req.get("powerType"))
-    powerUrl = xss_escape(req.get("powerUrl"))
-    sort = xss_escape(req.get("sort"))
+    icon = str_escape(req.get("icon"))
+    openType = str_escape(req.get("openType"))
+    parentId = str_escape(req.get("parentId"))
+    powerCode = str_escape(req.get("powerCode"))
+    powerName = str_escape(req.get("powerName"))
+    powerType = str_escape(req.get("powerType"))
+    powerUrl = str_escape(req.get("powerUrl"))
+    sort = str_escape(req.get("sort"))
     power = Power(
         icon=icon,
         open_type=openType,
@@ -96,14 +96,14 @@ def update():
     req_json = request.json
     id = request.json.get("powerId")
     data = {
-        "icon": xss_escape(req_json.get("icon")),
-        "open_type": xss_escape(req_json.get("openType")),
-        "parent_id": xss_escape(req_json.get("parentId")),
-        "code": xss_escape(req_json.get("powerCode")),
-        "name": xss_escape(req_json.get("powerName")),
-        "type": xss_escape(req_json.get("powerType")),
-        "url": xss_escape(req_json.get("powerUrl")),
-        "sort": xss_escape(req_json.get("sort"))
+        "icon": str_escape(req_json.get("icon")),
+        "open_type": str_escape(req_json.get("openType")),
+        "parent_id": str_escape(req_json.get("parentId")),
+        "code": str_escape(req_json.get("powerCode")),
+        "name": str_escape(req_json.get("powerName")),
+        "type": str_escape(req_json.get("powerType")),
+        "url": str_escape(req_json.get("powerUrl")),
+        "sort": str_escape(req_json.get("sort"))
     }
     res = Power.query.filter_by(id=id).update(data)
     db.session.commit()
diff --git a/applications/view/admin/role.py b/applications/view/admin/role.py
index 63c9078..1b4a5e8 100644
--- a/applications/view/admin/role.py
+++ b/applications/view/admin/role.py
@@ -4,7 +4,7 @@ from applications.common.curd import model_to_dicts, enable_status, disable_stat
 from applications.common.helper import ModelFilter
 from applications.common.utils.http import table_api, success_api, fail_api
 from applications.common.utils.rights import authorize
-from applications.common.utils.validate import xss_escape
+from applications.common.utils.validate import str_escape
 from applications.extensions import db
 from applications.models import Role, Power, User
 from applications.schemas import RoleOutSchema, PowerOutSchema2
@@ -23,21 +23,15 @@ def main():
 @admin_role.get('/data')
 @authorize("admin:role:main", log=True)
 def table():
-    # 获取请求参数
-    role_name = xss_escape(request.args.get('roleName', type=str))
-    role_code = xss_escape(request.args.get('roleCode', type=str))
-    # 查询参数构造
-    mf = ModelFilter()
+    role_name = str_escape(request.args.get('roleName', type=str))
+    role_code = str_escape(request.args.get('roleCode', type=str))
+    filters = []
     if role_name:
-        mf.vague(field_name="name", value=role_name)
+        filters.append(Role.name.contains(role_name))
     if role_code:
-        mf.vague(field_name="code", value=role_code)
-    # orm查询
-    # 使用分页获取data需要.items
-    role = Role.query.filter(mf.get_filter(Role)).layui_paginate()
-    count = role.total
-    # 返回api
-    return table_api(data=model_to_dicts(schema=RoleOutSchema, data=role.items), count=count)
+        filters.append(Role.code.contains(role_code))
+    roles = Role.query.filter(*filters).layui_paginate()
+    return table_api(data=model_to_dicts(schema=RoleOutSchema, data=roles.items), count=roles.total)
 
 
 # 角色增加
@@ -52,11 +46,11 @@ def add():
 @authorize("admin:role:add", log=True)
 def save():
     req = request.json
-    details = xss_escape(req.get("details"))
-    enable = xss_escape(req.get("enable"))
-    roleCode = xss_escape(req.get("roleCode"))
-    roleName = xss_escape(req.get("roleName"))
-    sort = xss_escape(req.get("sort"))
+    details = str_escape(req.get("details"))
+    enable = str_escape(req.get("enable"))
+    roleCode = str_escape(req.get("roleCode"))
+    roleName = str_escape(req.get("roleName"))
+    sort = str_escape(req.get("sort"))
     role = Role(
         details=details,
         enable=enable,
@@ -109,10 +103,10 @@ def save_role_power():
     power_list = power_ids.split(',')
     role_id = req_form.get("roleId")
     role = Role.query.filter_by(id=role_id).first()
-    
+
     powers = Power.query.filter(Power.id.in_(power_list)).all()
     role.power = powers
-    
+
     db.session.commit()
     return success_api(msg="授权成功")
 
@@ -132,11 +126,11 @@ def update():
     req_json = request.json
     id = req_json.get("roleId")
     data = {
-        "code": xss_escape(req_json.get("roleCode")),
-        "name": xss_escape(req_json.get("roleName")),
-        "sort": xss_escape(req_json.get("sort")),
-        "enable": xss_escape(req_json.get("enable")),
-        "details": xss_escape(req_json.get("details"))
+        "code": str_escape(req_json.get("roleCode")),
+        "name": str_escape(req_json.get("roleName")),
+        "sort": str_escape(req_json.get("sort")),
+        "enable": str_escape(req_json.get("enable")),
+        "details": str_escape(req_json.get("details"))
     }
     role = Role.query.filter_by(id=id).update(data)
     db.session.commit()
@@ -179,7 +173,7 @@ def remove(id):
     # 删除该角色的权限和用户
     role.power = []
     role.user = []
-    
+
     r = Role.query.filter_by(id=id).delete()
     db.session.commit()
     if not r:
@@ -198,7 +192,7 @@ def batch_remove():
         # 删除该角色的权限和用户
         role.power = []
         role.user = []
-        
+
         r = Role.query.filter_by(id=id).delete()
         db.session.commit()
     return success_api(msg="批量删除成功")
diff --git a/applications/view/admin/user.py b/applications/view/admin/user.py
index a7a1605..18f962b 100644
--- a/applications/view/admin/user.py
+++ b/applications/view/admin/user.py
@@ -4,10 +4,9 @@ from sqlalchemy import desc
 
 from applications.common import curd
 from applications.common.curd import enable_status, disable_status
-from applications.common.helper import ModelFilter
 from applications.common.utils.http import table_api, fail_api, success_api
 from applications.common.utils.rights import authorize
-from applications.common.utils.validate import xss_escape
+from applications.common.utils.validate import str_escape
 from applications.extensions import db
 from applications.models import Role, Dept
 from applications.models import User, AdminLog
@@ -27,17 +26,20 @@ def main():
 @authorize("admin:user:main", log=True)
 def data():
     # 获取请求参数
-    real_name = xss_escape(request.args.get('realName', type=str))
-    username = xss_escape(request.args.get('username', type=str))
+    real_name = str_escape(request.args.get('realName', type=str))
+
+    username = str_escape(request.args.get('username', type=str))
     dept_id = request.args.get('deptId', type=int)
-    # 查询参数构造
-    mf = ModelFilter()
+
+    filters = []
     if real_name:
-        mf.contains(field_name="realname", value=real_name)
+        filters.append(User.realname.contains(real_name))
     if username:
-        mf.contains(field_name="username", value=username)
+        filters.append(User.realname.contains(username))
     if dept_id:
-        mf.exact(field_name="dept_id", value=dept_id)
+        filters.append(User.realname == dept_id)
+
+    # print(*filters)
     data, count = db.session.query(
         User.id,
         User.username,
@@ -46,8 +48,8 @@ def data():
         User.create_at,
         User.update_at,
         Dept.dept_name
-    ).filter(mf.get_filter(model=User)).filter(User.dept_id==Dept.id).layui_paginate_db_json()
-    return table_api(data=data,count=count)
+    ).filter(*filters).filter(User.dept_id == Dept.id).layui_paginate_db_json()
+    return table_api(data=data, count=count)
 
 
 # 用户增加
@@ -63,9 +65,9 @@ def add():
 def save():
     req_json = request.json
     a = req_json.get("roleIds")
-    username = xss_escape(req_json.get('username'))
-    real_name = xss_escape(req_json.get('realName'))
-    password = xss_escape(req_json.get('password'))
+    username = str_escape(req_json.get('username'))
+    real_name = str_escape(req_json.get('realName'))
+    password = str_escape(req_json.get('password'))
     role_ids = a.split(',')
 
     if not username or not real_name or not password:
@@ -114,11 +116,11 @@ def edit(id):
 @authorize("admin:user:edit", log=True)
 def update():
     req_json = request.json
-    a = xss_escape(req_json.get("roleIds"))
-    id = xss_escape(req_json.get("userId"))
-    username = xss_escape(req_json.get('username'))
-    real_name = xss_escape(req_json.get('realName'))
-    dept_id = xss_escape(req_json.get('deptId'))
+    a = str_escape(req_json.get("roleIds"))
+    id = str_escape(req_json.get("userId"))
+    username = str_escape(req_json.get('username'))
+    real_name = str_escape(req_json.get('realName'))
+    dept_id = str_escape(req_json.get('deptId'))
     role_ids = a.split(',')
     User.query.filter_by(id=id).update({'username': username, 'realname': real_name, 'dept_id': dept_id})
     u = User.query.filter_by(id=id).first()
diff --git a/applications/view/department/__init__.py b/applications/view/department/__init__.py
index 322c87a..9923150 100644
--- a/applications/view/department/__init__.py
+++ b/applications/view/department/__init__.py
@@ -4,7 +4,7 @@ from applications.common import curd
 from applications.common.utils import validate
 from applications.common.utils.http import success_api, fail_api
 from applications.common.utils.rights import authorize
-from applications.common.utils.validate import xss_escape
+from applications.common.utils.validate import str_escape
 from applications.extensions import db
 from applications.models import Dept, User
 from applications.schemas import DeptOutSchema
@@ -58,13 +58,13 @@ def save():
     req_json = request.json
     dept = Dept(
         parent_id=req_json.get('parentId'),
-        dept_name=xss_escape(req_json.get('deptName')),
-        sort=xss_escape(req_json.get('sort')),
-        leader=xss_escape(req_json.get('leader')),
-        phone=xss_escape(req_json.get('phone')),
-        email=xss_escape(req_json.get('email')),
-        status=xss_escape(req_json.get('status')),
-        address=xss_escape(req_json.get('address'))
+        dept_name=str_escape(req_json.get('deptName')),
+        sort=str_escape(req_json.get('sort')),
+        leader=str_escape(req_json.get('leader')),
+        phone=str_escape(req_json.get('phone')),
+        email=str_escape(req_json.get('email')),
+        status=str_escape(req_json.get('status')),
+        address=str_escape(req_json.get('address'))
     )
     r = db.session.add(dept)
     db.session.commit()
@@ -115,13 +115,13 @@ def update():
     json = request.json
     id = json.get("deptId"),
     data = {
-        "dept_name": validate.xss_escape(json.get("deptName")),
-        "sort": validate.xss_escape(json.get("sort")),
-        "leader": validate.xss_escape(json.get("leader")),
-        "phone": validate.xss_escape(json.get("phone")),
-        "email": validate.xss_escape(json.get("email")),
-        "status": validate.xss_escape(json.get("status")),
-        "address": validate.xss_escape(json.get("address"))
+        "dept_name": validate.str_escape(json.get("deptName")),
+        "sort": validate.str_escape(json.get("sort")),
+        "leader": validate.str_escape(json.get("leader")),
+        "phone": validate.str_escape(json.get("phone")),
+        "email": validate.str_escape(json.get("email")),
+        "status": validate.str_escape(json.get("status")),
+        "address": validate.str_escape(json.get("address"))
     }
     d = Dept.query.filter_by(id=id).update(data)
     if not d: