javascript - Why does adding </script> in a comment break the parser? -
this question has answer here:
why adding </script>
in comment break parser? bug or there in documentation i've overlooked?
i've tested in chrome, firefox, opera, internet explorer , produce same result.
single-line comment:
function foo(){ // </script> alert("bar"); }; foo();
multi-line comment:
function foo(){ /* </script> */ alert("bar"); }; foo();
this happens because html parser defined w3c totally separated javascript parser. after <script>
tag looks closing </script>
, regardless it's inside comments or strings, because treats js code normal text.
Comments
Post a Comment