in my experience this works just fine. the browser unescapes _javascript_ before passing it to the interpreter. we should still test this. here is a small test page.

<html>
<body>
<a href="" b=3; if (b&lt;4) a++; if (a==6) alert(&#039;success&#039;); else alert(&#039;failure&#039;);">test</a>
</body>
</html>

it should alert success when you click on the link.

i tried it in IE6 and FireFox 1.5rc3

-Igor


On 11/24/05, Laurent PETIT <[EMAIL PROTECTED]> wrote:

On 11/24/05, Johan Compagner < [EMAIL PROTECTED]> wrote:
My question was will _javascript_ always work for all the browsers if it is escaped??

Correct, I didn't answer to the right question, sorry.

<input type="xxx" x=10;if(y<20) z = y + 'text' + x/2 + 20;">
escaped it will be:
<input type="xxx" x=10;if(y&lt;20) z = y + &#039;text&#039; + x/2 + 20;">

Will that always work in every browser?

I'm tempted to answer a big yes.
But as I've not tested it by myself, I'll try & see some formal answer.
And maybe try by myself with the most usefull,as well as (maybe) sending to the list a plain old html file for the willing users to test & try on different browsers (on windows flavors, linux, mac os x, ...)

If that is the case then there is no problem and we can escape attributes everytime. i think.

I think so.


Reply via email to