views:

19

answers:

0

I have a form that accepts javascript which allows the use of document.write() and I want to validate the output of the javascript which may look like this:

var a = 'book1';
var b = 2;

document.write("</scr"+"ipt>");
document.write("<scr"+"ipt type='text/javascript'src='http://www.example.com/loader.js?mydoc="+a+"&amp;page="+b+"'&gt;");

I have found that some browsers will automagically fix this issue when the code is run on a page and load the loader.js file, but others won't. What I want is to make sure users know that the above code is invalid and won't run as expected -- but I'm unsure where to start.

Thanks in advance for any insights!