3 ms·
I debated whether or not to mention this, and in the end decided I didn't want an in-depth discussion of edge cases to overwhelm the basic message I was trying
by rgrove 15y ago
I debated whether or not to mention this, and in the end decided I didn't want an in-depth discussion of edge cases to overwhelm the basic message I was trying to get across, which is that context is key.
As far as I know, ` is only an issue when using user input in innerHTML with IE. Are there other situations where it can be harmful?
- nbpoole 15y ago` can be used in place of single or double quotes around attribute values in IE.
- rgrove 15y agoMy understanding (and I tested to confirm) is that IE only treats ` as an attribute delimiter when it's assigned to an element's innerHTML value dynamically. So this is important when working with client-side code, but not so much when generating HTML on the server. Am I wrong?
- nbpoole 15y agoI just tried the following HTML: <input type="text" value=`asdf` /> In IE, the input box contained the string asdf. In other browsers, it contained the string `asdf`
- rgrove 15y agoYou're right. I was mistakenly testing only a limited case (described at http://html5sec.org/#59 http://html5sec.org/#59). Thanks!