One fun thing to be aware of is escaping requirements. <script>alert("<".length)</script> In HTML with HTML syntax, this will alert 4, the string being "<".

One fun thing to be aware of is escaping requirements. <script>alert("<".length)</script> In HTML with HTML syntax, this will alert 4, the string being "<". In HTML with XML syntax (yes, still a thing), or in SVG standalone, or in SVG in HTML of either syntax, this will alert 1, the string being "<". There’s a lot more one can talk about with this, HTML parser details, script data double escaped state, CDATA, but I’ll leave it at that. Just don’t be surprised when you see this sort of thing in your SVG: if (a < b) { … } Allowing users to place JavaScript inside a <script> tag in HTML but preventing them from breaking out of it is rather difficult, requiring semantic handling of the JavaScript and some rather convoluted changes which could still break things. Similar deal on CSS, just that it can be done perfectly since you don’t have to worry about Function.prototype.toString detecting the changes. But no, if you want to do such a thing, the sensible and principled way is either to serve the document with XML syntax (though there are various problems with this and I don’t advise trying), or to use SVG’s <script> or <style> instead of HTML’s, and do regular HTML entity encoding of the source. <svg><script>…</script></svg>, easy enough.