Nuno Canas wrote:
> &js<alert(#(id)#)>
> should be:
> &js<alert('#(id)#')>In this case he is passing in a valid JavaScript literal (1234), so it should work. You are correct that it should be quoted unless the substitution is a valid JavaScript expression to be evaluated by JavaScript.
