I have a form that accepts javascript which allows the use of document.write() and I want to validate the output of the javascript which may look like this:
var a = 'book1';
var b = 2;
document.write("</scr"+"ipt>");
document.write("<scr"+"ipt type='text/javascript'src='http://www.example.com/loader.js?mydoc="+a+"&page="+b+"'>");
I have found that some browsers will automagically fix this issue when the code is run on a page and load the loader.js file, but others won't. What I want is to make sure users know that the above code is invalid and won't run as expected -- but I'm unsure where to start.
Thanks in advance for any insights!