> Naturally your examples do not error since you have > demonstrated a JavaScript string containing the text > "</script>" which is not contained within "real" script tags. > My onus however, was not to prove that EVERY arbitrary > "</script>" embedded within a JS string in an HTML document > would error but rather the possibility of such errors were > not an "edge case". Your examples, while accurate, do not > preclude the many ways JS strings can and are contained > within real script tags.
I wrote that it was an edge case because you're the first person to have both encountered this problem and to also have suggested that CF isn't doing what it should. The point of my examples wasn't to preclude anything, it was simply to demonstrate that this has nothing to do with the safety of JavaScript strings. Should CF automatically do something special when it encounters the string "</script>" within a JSStringFormat function? Even if it's not necessary? Should it look for other edge case situations that you haven't encountered yet? If not, why not? I wouldn't be surprised if a bunch of them exist, since you can put JavaScript string literals almost anywhere within an HTML page. > -- The CF Docs appear to only be accurate based on how > tightly you define "safe". The point of the function is to create a JavaScript string literal. It does that. Just like XMLFormat escapes XML metacharacters, and URLEncodedFormat escapes URL metacharacters. Both create "safe" strings for use within specific environments. Neither of those functions look for specific problems that could break XML documents or URLs, either. Why would you expect this one function to behave differently from all of the other ___Format functions? > -- The CF docs are for public consumption, not for a > super-elite ring of CFer's who already have intimate > knowledge of the language. You don't have to be a super-elite anything, you just have to understand how JavaScript works within a browser. Dave Watts, CTO, Fig Leaf Software http://www.figleaf.com/ Fig Leaf Software provides the highest caliber vendor-authorized instruction at our training centers in Washington DC, Atlanta, Chicago, Baltimore, Northern Virginia, or on-site at your location. Visit http://training.figleaf.com/ for more information! ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~| Adobe® ColdFusion® 8 software 8 is the most important and dramatic release to date Get the Free Trial http://ad.doubleclick.net/clk;160198600;22374440;w Archive: http://www.houseoffusion.com/groups/CF-Talk/message.cfm/messageid:295615 Subscription: http://www.houseoffusion.com/groups/CF-Talk/subscribe.cfm Unsubscribe: http://www.houseoffusion.com/cf_lists/unsubscribe.cfm?user=89.70.4
