javascript - Content not appear in body -
i have file a.html, has following content:
<script> var x=document.url.substring(document.url.indexof('#')+1); document.write(x); alert(document.body.innerhtml); </script> <body> </body> when browsing a.html#somevalueh;alert(1)</script>, why "somevalueh;alert(1)" not </script> portion appeared inside body?
i using chrome btw.
this happening because </script> tag has special meaning browser , has opening tag, silently droping it.
try escaping url hint this:
<script> var x=document.url.substring(document.url.indexof('#')+1); document.write(escape(x)); alert(document.body.innerhtml); </script> <body> </body> this give output:
somevalueh%3balert%281%29%3c/script%3e escaping special characters.
update:
may want try this. using html change somevalueh;alert(1)</script> somevalueh;<script>alert(1)</script>
and inspect page, must see <script></script> in body tag.
Comments
Post a Comment