javascript - Why does adding </script> in a comment break the parser? -
this question has answer here:
why adding </script> in comment break parser? bug or there in documentation i've overlooked?
i've tested in chrome, firefox, opera, internet explorer , produce same result.
single-line comment:
function foo(){ // </script> alert("bar"); }; foo(); multi-line comment:
function foo(){ /* </script> */ alert("bar"); }; foo();
this happens because html parser defined w3c totally separated javascript parser. after <script> tag looks closing </script>, regardless it's inside comments or strings, because treats js code normal text.
Comments
Post a Comment