I have the following middleware:

import { encode } from 'html-entities';

const xssProtect = (req, res, next) => {
  for (const key in req.query) {
    if (typeof req.query[key] === 'string') {
      const encoded = encode(req.query[key]);

      console.log(encoded);
      req.query[key] = encoded;
    }
  }

  console.log(req.query);

  next();
}

export default xssProtect;

When I display the value of encoded it properly displays the value encoded, for example becomes <script>abcé</script>, so I'm expecting req.query[key] to take the value of encoded when doing the assignment. However, when I display req.query I have the object without any changes, e.g.:

{
  p: ''
}

How to have the value encoded?