-1

I am having problem with tag once I want to intialize it into String. Before posting this question< I have looked several already asked questions regarding closing tag in string:

But, in my case, I cannot slipt into two parts like:

var test = '...... </scr'+'ipt>......';

Because, I receive it from Backend directly as one variable, I want to do it in Frontend without touching representation of in Backend.

<body>
   <p id="one">This is a text</p>

   <script type="text/javascript">

     var some = '<script>alert(\"from Learning objective title\")</script>';

     document.getElementById("one").innerHTML = some;

  </script>
</body>

I would appreciate any help. Thanks.

Doston
  • 579
  • 6
  • 15
  • FYI, you don't need to escape double quotes inside single quotes. – Barmar Nov 15 '19 at 16:24
  • 1
    How are you receiving it from the back-end? The issue only affects JavaScript literals in ` – Barmar Nov 15 '19 at 16:25
  • hm, yeah, I am wrong and I understood that there is no way to initialize whole string with tag then escape tag. Thanks. – Doston Nov 15 '19 at 19:13

1 Answers1

0

You can't.

It has to be escaped before being inserted into the HTML document.

This is a fundamental feature of how escaping works.

Quentin
  • 914,110
  • 126
  • 1,211
  • 1,335