3 ms·
Reminds me of an example I gave in my book about how you can write valid HTML that executes as JS: /* <div id="writeHere"></div> <script src="#"></
by chewxy 12y ago
Reminds me of an example I gave in my book about how you can write valid HTML that executes as JS:
/*
<div id="writeHere"></div>
<script src="#"></script>
<div>For example here, we have multiple examples of code that execute</div>
<!--
*/
writeHere.innerHTML='<p style="font-weight:bolder">Hello World</p>'
alert("are we JavaScript files or are we HTML?")
/*
-->
*/
I saw this once upon a time while debugging some nasty code some publishers used - the whole site was in this style. It was one of the most ingenious things I've seen - the same file, parsed twice, once as HTML and once as JS.
- kristopolous 12y agoWow is that ever clever!
- aidos 12y agoYou'll end up with the leading '/*' (and trailing) showing in the html though. Not much you can do about it I guess (except probably use a css hack to hide it). ps I don't envy anybody who has to spend their day working on code that looks like that!
- dmak 12y agoThis is interesting, could you explain this more in detail?
- Kiro 12y agoNot OP but: 1. Page is parsed as HTML, ignoring the JS since it's wrapped in HTML comments. 2. script src="#" loads itself. 3. Page is parsed as JS, ignoring the HTML since it's wrapped in JS comments.
- MasterScrat 12y agoI fail to see why anyone would use that instead of inline <script> tags? Is it because each tag would then be parsed and run in order, ie you couldn't declare a function at the end of the page that you'd use at the top? It's the only explanation that comes to mind...
- chewxy 12y agoIIRC I was investigating a click fraud or impression fraud issue and I came across an entire site written in this fashion. They were doing something funky with the ad tags that loaded on the page. Clearly they think it will deter people from discovering their naughty misdeeds