4 ms·
Good point! To be perfectly safe, `$div.attr('id')` should be escaped before it’s used. I’m not sure in how many browsers this could be a problem though. FYI,
by mathias 16y ago
Good point! To be perfectly safe, `$div.attr('id')` should be escaped before it’s used. I’m not sure in how many browsers this could be a problem though.
FYI, the `.append` line is missing a closing `)`. Also, you probably don’t want to use `$(this)` in that case, you could just use `this`.
- IgorPartola 16y agoOops! Thanks for pointing out the closing ). Both '$(this)' and 'this' work, and I just use the former most of the time. I suppose you are right though since $(this) would take longer. On the other hand, I wouldn't be surprised if the HTML element was immediately converted to a jQuery object by append() before anything else is done anyways. As for the escaping, how would we do that? jQuery specifically allows something like $('<div/>'). As far as I know, it does not have an escape character to prevent that. My point is that that character would need to be added to jQuery and other libraries that have the same function for fetching DOM elements and creating them. Obviously, in raw JavaScript this is not a problem since there it's two different methods (document.getElementById and document.createElement).
- mathias 16y agoIsn’t escaping usually done with a backslash (`\`) instead of a forward slash (`/`)? I don’t see how something like `$('<div />');` could interfere with that.
- IgorPartola 16y agoJavaScript escaping is done with backslashes: var str = "Hello \"world\", how\\are you"; But once you have your string composed, jQuery does not as far as I know have a way to escape characters like < and >.