I am exploring the HTML5 tokenizator and wonder about the double escape state. You can jump into this state with:
<script>
<!--<script>script data double escaped</script>-->
</script>
Just for the info, there is also (single) escaped state:
<script>
<!--script data escaped-->
</script>
I was not able to find/figure yet the differences of the single and double escaped and its purpose? Also, I don't see in the tokenization section of the documentation any use of the "\" char for escaping the script tag like this: <\/script>. Am I missing something or I am just tired ;) What is all this about the single/double script states?
EDIT
From the comment: escaping script tag (<\/script>) is handled by javascript parser and does not have anything with HTML parser. So... what is the story behind the single/double states?
When Javascript was first introduced, many browsers did not support it. So they would render the content of the script tag - the javascript code itself. The normal way to get around that was to put the script into a comment - things like
<script>
<!-- //hide from non-JS browsers
function doSomething() {
var coolScript = "<script>" + theCodeICopied + "</script>";
document.write(coolScript);
}
// And if you forget to close your comment here, things go funnny
-->
</script>
were relatively normal. So scripts written within comments like this can do things like write script tags as literal strings into the middle of the document. That might seem like poor style today, but once upon a time there was not much by way of a DOM, either.
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With