Re: [whatwg] base64 entities

[Kornel Lesiński]

On Thu, 26 Aug 2010 21:56:12 +0100, Aryeh Gregor
<simetrical+...@gmail.com> wrote:
Suppose I have some arbitrary blob of trusted JavaScript, and I want
to output it as an inline script in text/html.  How do I escape it so
that it executes as intended -- in particular, given that it might
contain the string "</script>" in string literals, comments, and so
on?  In most contexts, you could just replace '<' => '&lt;', but that
doesn't work in inline <script>.

Inside strings you replace "</" with "<\/" ("\/" is valid escape sequence  
for "/"), outside strings you'd need to add space between "</" (a corner  
case x </regexliteral/).

You might also use <script src="data:">.

--
regards, Kornel