ansaurus

Question

cross site scripting using script tag ,change src of a script tag, can we use id for script tag

Answer 1

A:

According to W3C (http://www.w3.org/TR/REC-html40/interact/scripts.html#h-18.2.1) 'script' tag doesn't support any standard attributes (which includes 'id'), however it will work in most browsers. Instead of replacing 'script' tag 'src' attribute I would suggest removing the tag and adding new one - that’s more reliable. I would strongly suggest reading about JSONP and Cross-Origin Resource Sharing (http://www.w3.org/TR/cors/) - those are standards which should help you achieve what you want.

tpeczek 2010-10-19 09:48:17

The W3C is an organization that publishes specifications relating to the web. W3Schools is an organization that publishes poor quality tutorials but is good at SEO. They are **not** the same organization. The script element does support an id attribute in some versions of HTML.

David Dorward 2010-10-19 09:53:36

I have never wrote they are the same organization, although I admit I have posted wrong link (edited now). The rest stays true.

tpeczek 2010-10-19 10:07:24

Answer 2

A:

As @tpeczek mentioned, to change the script src attribute is not enough, some browsers will not reload the script.
Use the following to replace the tag:

var oldScript = document.getElementById('someID');
var script = document.createElement("script");        
script.setAttribute("type","text/javascript");                
script.setAttribute("id","someID");
script.setAttribute("src",url);

if (oldScript == null) {               
    document.body.appendChild(script);
} else {
    document.body.replaceChild(script, oldScript);
}

Dror 2010-10-19 09:50:11

Answer 3

A:

couldnt you go the old fashioned way and walk through all script elements and check the src to find some.js?

Tobias 2010-10-28 20:46:05

ansaurus

tags:

views:

answers:

cross site scripting using script tag ,change src of a script tag, can we use id for script tag

related questions