> I would have to disagree. I am not attempting to blame
> ColdFusion for the behavior of my browser. I am charging the
> documentation and behavior of the jsstringformat function to
> be misleading (and possibly too narrow) given the fact that
> it advertises "safe" strings. I figure the majority of
> JavaScript is found imbedded in HTML documents. Or at least
> the majority of JavaScript which would require the use of the
> jsstringformat function is found imbedded in HTML documents.
That alone doesn't mean that it won't work properly. Stick this in any HTML
document:
<a href="javascript:window.alert('</script>');">show closing script tag</a>
<a href="#" onmouseover="window.alert('</script>');">test me again</a>
You'll notice that it works just fine, in IE7 and Firefox 2.x at least. This
has nothing to do with the "safety" of JavaScript string literals at all,
and everything to do with HTML.
Dave Watts, CTO, Fig Leaf Software
http://www.figleaf.com/
Fig Leaf Software provides the highest caliber vendor-authorized
instruction at our training centers in Washington DC, Atlanta,
Chicago, Baltimore, Northern Virginia, or on-site at your location.
Visit http://training.figleaf.com/ for more information!
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
Adobe® ColdFusion® 8 software 8 is the most important and dramatic release to
date
Get the Free Trial
http://ad.doubleclick.net/clk;160198600;22374440;w
Archive:
http://www.houseoffusion.com/groups/CF-Talk/message.cfm/messageid:295608
Subscription: http://www.houseoffusion.com/groups/CF-Talk/subscribe.cfm
Unsubscribe: http://www.houseoffusion.com/cf_lists/unsubscribe.cfm?user=89.70.4
