On 6/20/07, Jonas Sicking <[EMAIL PROTECTED]> wrote:
Simon Pieters wrote: > FWIW, <script src> has empty content model but still requires the end tag. That is not true. The contents of a <script src> is interpreted as script and executed if loading the resource pointed to by the src-attribute fails. In other words <script src="http://nonexistant.example.com/";> alert('hi'); </script> should bring up an alert. / Jonas
That's not what section 3.17 currently says, and that's not the way Firefox behaves on my machine. Is that noted anywhere? -- Jon Barnett
