Sorry, deleted that comment before I saw your reply. As I read the whole article I realized that I had nothing interesting to add to it. :) And absolutely, CDA

Sorry, deleted that comment before I saw your reply. As I read the whole article I realized that I had nothing interesting to add to it. :) And absolutely, CDATA is a solution for that scenario. For the curious, what I blurted out before reading the whole thing: HTML rules where the script is, of course it would also decide where it ends -- without having to parse the javascript. As for XSS, if you are vulnerable to this one, you are probably vulnerable to other nifty tricks as well. If you -really- need to use the /script tag, then most people know that the cheap hack is to just: alert("</scr"+"ipt>");