why tag in js string is being validated

Question

I have following page

<html>
<head>
    <script type="text/javascript" src="e01.js"></script>
</head>
<body>
<script type="text/javascript">
var obj={someHTML: "<script>alert('a');</script>rest of the html",  
               someOtherAttribute:"some value"};
    alert(obj.someHTML);
</script>
</body>
</html>

in someHTML attribute of my object I have </script> tag in a string. but browser reads this as actual close tag and closes the script element. is there anything I am missing here? (tried it in ff and chrome)

hey I found a bug in stackoverFlow. I cannot write in a regular text. it is working in comments but not in an actual question — yilmazhuseyin, Aug 18 '10 at 07:46

score 5 · Accepted Answer · edited May 23 '17 at 12:31

5

HTML is parsed before and independent from Javascript. The current browser behavior is that, once an open tag <script> is found, the browser will switch to "Script Data State" and interpret all following data as script until a </script> is found.

Where the </script> is detected doesn't matter — inside a JS string, a JS comment, a CDATA section, or even HTML comment.

You need to make the string does not look like </script> to the HTML parser. The simplest way is to write <\/script> as in @Daniel's answer.

edited May 23 '17 at 12:31

Community

1
1

answered Aug 18 '10 at 07:36

kennytm

510,854
105
1,084
1,005

1

*Curious note:* Regarding the HTML4.01 spec, actually it should be the `ETAGO` sequence `` the token that would terminate a `SCRIPT` element's content, but seems that most browsers are permissive, and now the de-facto standard is `"';`... check [this test](http://kangax.github.com/jstests/etago_delimiter_test/). – Christian C. Salvadó Aug 18 '10 at 07:57

score 3 · Answer 2 · edited May 23 '17 at 11:59

3

You may want to escape the script tag, like this: <\/script>

var obj= {
   someHTML: "<script>alert('a');<\/script>rest of the html",  
   someOtherAttribute: "some value"
};

How can JavaScript make new page that contains more JavaScript?

edited May 23 '17 at 11:59

Community

1
1

answered Aug 18 '10 at 07:28

Daniel Vassallo

337,827
72
505
443

score 3 · Answer 3 · answered Aug 18 '10 at 07:30

You can either escape < and > by, respectively < and > or put the whole script in a CDATA section:

<script type="text/javascript">
<![CDATA[
var obj={someHTML: "<script>alert('a');</script>rest of the html",  
               someOtherAttribute:"some value"};
    obj(some.pageButtonScript);
]]>
</script>

score 0 · Answer 4 · answered Aug 18 '10 at 08:10

0

Another way of doing it can be this.

 var obj= {
 someHTML: "<script>alert('a');</scr"+"ipt>rest of the html",  
 someOtherAttribute: "some value"
 };

just put a space between the ending script tag, so it wont be parsed as End tag.

answered Aug 18 '10 at 08:10

Furqan Hameedi

4,372
3
27
34

why tag in js string is being validated

4 Answers4

Linked