ansaurus

Question

why </script> tag in js string is being validated

Answer 1

+3 A:

You may want to escape the script tag, like this: <\/script>

var obj= {
   someHTML: "<script>alert('a');<\/script>rest of the html",  
   someOtherAttribute: "some value"
};

How can JavaScript make new page that contains more JavaScript?

Daniel Vassallo 2010-08-18 07:28:51

Answer 2

+3 A:

You can either escape < and > by, respectively < and > or put the whole script in a CDATA section:

<script type="text/javascript">
<![CDATA[
var obj={someHTML: "<script>alert('a');</script>rest of the html",  
               someOtherAttribute:"some value"};
    obj(some.pageButtonScript);
]]>
</script>

Maurice Perry 2010-08-18 07:30:28

Answer 3

+4 A:

HTML is parsed before and independent from Javscript. The current browser behavior is that, once an open tag <script> is found, the browser will switch to "Script Data State" and interpret all following data as script until a </script> is found.

Where the </script> is detected doesn't matter — inside a JS string, a JS comment, a CDATA section, or even HTML comment.

You need to make the string does not look like </script> to the HTML parser. The simplest way is to write <\/script> as in @Daniel's answer.

KennyTM 2010-08-18 07:36:33

*Curious note:* Regarding the HTML4.01 spec, actually it should be the `ETAGO` sequence `</` the token that would terminate a `SCRIPT` element's content, but seems that most browsers are permissive, and now the de-facto standard is `"</script"`. It seems comprehensible, is really common to have for example HTML in strings e.g.: `var foo = '<span></span>';`... check [this test](http://kangax.github.com/jstests/etago_delimiter_test/).

CMS 2010-08-18 07:57:06

Answer 4

A:

Another way of doing it can be this.

 var obj= {
 someHTML: "<script>alert('a');</scr"+"ipt>rest of the html",  
 someOtherAttribute: "some value"
 };

just put a space between the ending script tag, so it wont be parsed as End tag.

Furqan 2010-08-18 08:10:02

ansaurus

tags:

views:

answers:

why </script> tag in js string is being validated

related questions