What exactly goes on inside document.write()?

Question

How exactly does document.write() work?

When I do

  document.write('<script src="file.js"><\/script>');

inside a script tag which is inside a head tag, document.write() inserts the tag within the head tag. (Since I've called it from within head tag)

When document.write is called after the page fully loads, it implicitly calls document.open() and then executes document.write()

My question is, after page load, when I call

document.write('hello');  //Inserts 'hello' within body tag

and when I call

document.write('<script src="file.js"><\/script>'); //Inserts within head tag

So how exactly does document.write() know what kind of string am I inserting? Does it parse the string too?

Check this one: http://stackoverflow.com/questions/5235321/how-do-i-load-a-javascript-file-dynamically — vaso123, Oct 01 '15 at 13:56
`document.write()` does nothing more than what it's name implies. — charlietfl, Oct 01 '15 at 13:56
@charlietfl And how does it decide, where in the document will it write? Within the body tag? Within the head tag? — Parth, Oct 01 '15 at 14:07
No..exactly where it is placed. If used after page loaded will wipe out the whole page — charlietfl, Oct 01 '15 at 14:10
@charlietfl True. And what after the wipe out? Try the 2nd and the 3rd code snippet on any web page — Parth, Oct 01 '15 at 14:12
No idea what that means. Just don't use it...it is desctructive — charlietfl, Oct 01 '15 at 14:13

Mihai · Accepted Answer · 2015-10-01T14:46:51.390

The browser treats all data inserted by document.write as if it came from the server, right after the script block which contains the write. So, if you document.write('<script>alert(1);</' + 'script>');, the browser will add another <script> element after the current one. Script blocks are executed no matter where they are, in the head or in the document body.

If the call to document.write happens after the page is loaded, a new document will be created.

Your third snippet will create an HTML document containing only a <script> tag. This is not valid HTML, so most browsers will magically create the <html> and <head> elements for you, and place the script element there.

What exactly goes on inside document.write()?

1 Answers1