Join GitHub today
GitHub is home to over 20 million developers working together to host and review code, manage projects, and build software together.
Script tags in newly created elements (not yet added to the html page) execute when they should not #837
Script tags inside of elements that have not been added to the HTML document should not execute until they are added to the HTML document.
$('<div />').html('<script>alert("This should not render")</script>');
An alert box is shown, even though this element is not in the HTML document.
If you do this with native JS, the script does not execute:
var elem = document.createElement('div'); elem.innerHTML = "<script>alert("This should not render")</script>"