ansaurus

Question

Answer 1

+2 A:

You need to escape it, else it will be a part of the HTML.

var test = 'what the hell... \<\/script\> \<h1\>why?!?!?!\<\/h1\>';

LiraNuna 2009-11-02 06:44:18

this is incorrect. this is a variable that is storing text. It is not inserted into the HTML. Using a tag other than script will not have the same results.

re5et 2009-11-02 06:47:26

It's the way XML is being rendered. You can also wrap the script with <![CDATA[ and ]]>. It won't happen with other tags because the way the XML parser work (notably it treats script as text, and not as code).

LiraNuna 2009-11-02 06:50:39

@LiraNuna Umm. No. An XML parser will treat `</script>` as "End of script" and `</notscript>` as a well-formness error. An HTML parser will treat `</anything>` as "end of script" and then if it is `</notscript>` as "Error with handling undefined by the specification". Only a tag soup parser (and possibly an HTML5 parser, I haven't read the draft closely enough to be sure) will treat `</notscript>` as part of the script.

David Dorward 2009-12-01 10:19:29

Oh, and if you wrap with CDATA markers then that won't fix it for tag soup parsers.

David Dorward 2009-12-01 10:21:50

Answer 2

+5 A:

What happens?

The browser HTML parser will see the </script> within the string and it will interpret it as the end of the script element.

Look at the syntax coloring of this example:

<script>
var test = 'foo... </script> bar.....';
</script>

Note that the word bar is being treated as text content outside of the script element...

A commonly used technique is to use the concatenation operator:

var test = '...... </scr'+'ipt>......';

CMS 2009-11-02 06:44:24

This does work, but I am surprised that I have to do it. Part of the problem is that I am scraping a page and storing the results in a JS variable. I have no real expectations of what Is coming back.

re5et 2009-11-02 06:51:36

How are you storing it in a variable? Are you scraping server-side then generating `var x = <string>;`? If so, don't forget to JSON-encode it.

orip 2009-12-01 10:10:58

Escape the /, don't split the string up into parts. IIRC it is still an error in HTML 4.x. It is certainly more fiddly to type, messier to read, more characters to deal with, and less efficient (since string concatenation isn't the cheapest of JS operations)

David Dorward 2009-12-01 10:20:55

great i never knew it. :)

Rakesh Juyal 2009-12-01 11:37:38

Answer 3

A:

Another way to go arround this problem, and the most standart way would be doing something like this:

<script>
<![CDATA[
   var test = 'foo... </script> bar.....';
]]>
</script>

Hippo 2009-12-01 11:35:19

This does not work.

Tom Ritter 2010-06-11 21:34:23

ansaurus

tags:

views:

answers:

Script tag in JavaScript string

related questions