Whether it will alert ?

Question

Hi is this correct

<a href="#" style="color:#FFF;"onclick="add('alert("Google !")');" id="cricket" tabindex="1" name="cricket">cricket</a>

Answer 1

No.

onclick="add('alert("

You don't have a complete JavaScript statement inside your attribute value.

Some authors use the character entity reference """ to encode instances of the double quote mark (") since that character may be used to delimit attribute values.

— http://www.w3.org/TR/html4/charset.html#h-5.3

(And as an aside:

• Don't use href="#", build on stuff that works
• Don't use the style attribute, separate presentation and content
• Don't forget to put spaces between your attributes
• Don't use intrinsic event attributes (such as onclick), use unobtrusive JS (which would also solve the problem of the nested quotes)
• Where possible, avoid tabindex in favour of a sensible natural tab order )

Answer 2

onclick="add('alert("Google !")');" is being parsed as:

onclick        # attribute name
=
"add('alert("  # string
Google !       # random garbage
")');"         # another string

You'll have to escape the inner quotes, otherwise they terminate the string:

onclick="add('alert("Google !")');"

Beyond that, it depends on what add() does.