Question

I need to append the following code via innerHTML to a HTML textfield.

<script type="text⁄javascript"><!--
my_client = "test/test2/456789";
my_num = "gjhklasd";
my_width = 728;
my_height = 90;
my_page_url = "${SOMEURL}";
//-->
</script>

Is there an alternative to escaping above code for JavaScript other than making it look like?

<script type="text⁄javascript"><! etc.

I’m asking because escaping the snippet with above entities results in “ghost script” to be inserted e.g. <!-- appears all of the sudden at places where I didn’t put it.

As aside this might be a Browser Bug I discovered. Reproducable on Firefox 9 for Windows and Opera 11 for Linux.

Answer 1

You could try using the innerText property which should handle the escaping automatically. You’ll just have to avoid having the sequence </script> in a string literal in a JavaScript block. (There’s an explanation in one of the related questions.) You can work around this for instance by breaking up the tag:

var t = '<script type="text/javascript"><!--\n\
    abc\n\
        --></script'+'>';
elmt.innerText = t; 

jsFiddle: http://jsfiddle.net/pB24u/2/