Skip to content

Commit

Permalink
Generalize recommendations to escape script in literals
Browse files Browse the repository at this point in the history
Issue: #7179
  • Loading branch information
mathiasbynens committed Oct 18, 2021
1 parent 3285b98 commit e4c289a
Showing 1 changed file with 5 additions and 5 deletions.
10 changes: 5 additions & 5 deletions source
Original file line number Diff line number Diff line change
Expand Up @@ -59464,9 +59464,9 @@ o............A....e

<p class="note">The easiest and safest way to avoid the rather strange restrictions described in
this section is to always escape an ASCII case-insensitive match for "<code
data-x="">&lt;!--</code>" as "<code data-x="">&lt;\!--</code>", "<code
data-x="">&lt;script</code>" as "<code data-x="">&lt;\script</code>", and "<code
data-x="">&lt;/script</code>" as "<code data-x="">&lt;\/script</code>" when these sequences appear
data-x="">&lt;!--</code>" as "<code data-x="">\x3C!--</code>", "<code
data-x="">&lt;script</code>" as "<code data-x="">\x3Cscript</code>", and "<code
data-x="">&lt;/script</code>" as "<code data-x="">\x3C/script</code>" when these sequences appear
in literals in scripts (e.g. in strings, regular expressions, or comments), and to avoid writing
code that uses such constructs in expressions. Doing so avoids the pitfalls that the restrictions
in this section are prone to triggering: namely, that, for historical reasons, parsing of
Expand Down Expand Up @@ -59551,8 +59551,8 @@ console.log(example);</code></pre>
avoided entirely:</p>

<pre><code class="html">&lt;script><mark>
// Note: `\s` is an escape sequence for `s`.
var example = 'Consider this string: &lt;\!-- &lt;\script>';
// Note: `\x3C` is an escape sequence for `&lt;`.
var example = 'Consider this string: \x3C!-- \x3Cscript>';
console.log(example);
</mark>&lt;/script>
&lt;!-- this is just a comment between script blocks -->
Expand Down

0 comments on commit e4c289a

Please sign in to comment.