views:

204

answers:

5

If I add this piece of html to my page:

<script type="text/javascript">
 var s = '</script>'
</script>

IE 7.0 shows a syntax error (exclamation mark in left bottom corner): "Unterminated string constant"

if I change just one letter (any) the error disappears - looks like IE doesn't like this particular word, including brackets.

Any ideas why?

Thank you, Andrey

+1  A: 

I've seen this...

var s = '</scr' + 'ipt>'

That said, it gives off a bit of a code smell. I'm not sure if it's appropriate. :)

Mayo
I find it amusing that the other answer that had string concatenation in it was upvoted, while this one was down voted.
nilamo
Yea, what's up with that?
Christopher W. Allen-Poole
This is what Yahoo does.
womp
+4  A: 

This will happen for any browser. The HTML parser does not know the details of the scripting language you're trying to use, so your <script> tag will be terminated on the first occurence of </script>, regardless of context. The JS parser will then of course complain that the string is not terminated, because the closing apostrophe is not inside the script block.

You need to use something like '<\/script>' instead if you want to use that scring in your script.

Michael Madsen
Would the downvoters care to elaborate on their reasons for doing so?
Michael Madsen
IIRC, it is "</" that terminates SCRIPT tag.
kangax
I would consider an HTML parser that worked like that as being broken. since that goes against all other HTML principles - </> might break it as well due to its property as an "anonymous close tag" in SGML, but most certainly not </.
Michael Madsen
Having said that, I have not exhaustively tested all browsers for this, but IE 8 certainly doesn't behave like that.
Michael Madsen
I'm not familiar with SGML rules in this regard, but I just checked again and HTML does indeed explicitly state that "</" is what terminates SCRIPT (other than that sequence, element's contents are just plain CDATA) - http://www.w3.org/TR/REC-html40/types.html#type-cdata
kangax
Actually, thinking a bit more about it, that makes sense - at least as far as validity is concerned. I would still expect actual implementations to require the full end tag, but that would be more of a side effect from the necessity for them to handle invalid HTML as well - for the sake of completeness, though, I'll edit accordingly.
Michael Madsen
+7  A: 

This works for me

var a = "<\/script>"
dharga
Thanks, it did the trick!
Andrey
why the downvote? it works!
dharga
You can should also be able to wrap your code in `<!-- -->` (or `<![CDATA[ ]]>` if it's being parsed as X(HT)ML).
Wevah
You should NOT wrap the code in <!-- -->. We don't need to cater for Netscape 2 any more.
David Dorward
Neither should you wrap your code in `<![CDATA[..]]>` without commenting it out. `<![CDATA[..]]>` is an XML literal in JavaScript 1.6+ and nothing in it would be processed as code
Eli Grey
+3  A: 

To use a / character you need to first preface it with \.

So this works:

<script type="text/javascript"> var s = '<\/script>'; alert( s);</script>
Nissan Fan
A: 

I've seen this:

var s = unescape("%3C/script%3E")

Smells really bad too.

deverop