Question

I need to insert customer created content from an input textarea using $.html() of jquery to another div on the page for a live preview feature

But if customer typed javascript inside the content, like:

<script type='text/javascript'>
alert('abc');
</script>

When calling this with .html(), the javascript will get executed, and if I use .text(), then the content will not be regarded as html.

How could I fix this? I created a jsfiddle for it: http://jsfiddle.net/larryzhao/VL82f/

Update:
Maybe I need to made it more clear, I am doing a preview for markdown. So user enters markdown on the textarea, and I converted to html, and display it to the div#dest. What if the user enters script as displayed above? Is there any way to keep the original type but not execute it? If there’s not, then I think I would just write a regexp to wipe the script block out I think..

I found two online markdown tool:
http://daringfireball.net/projects/markdown/dingus this one executes it
http://www.ctrlshift.net/project/markdowneditor/ and this one just wipe the script block out

Answer 1

Why not locate a <script>...</script> and escape the characters in the section of the code?

For example:

<script src="test/javascript>
var userInput=document.getElementByID("#input");
..
..
..
</script>


&lt;script src=&quot;test/javascript&gt;
var userInput=document.getElementByID(&quot;#input&quot;);
..
..
..
&lt;/script&gt;