Skip to content

Instantly share code, notes, and snippets.

@newtonapple

newtonapple/gist:671669

Created November 10, 2010 22:39
Show Gist options
  • Save newtonapple/671669 to your computer and use it in GitHub Desktop.
Save newtonapple/671669 to your computer and use it in GitHub Desktop.
Download ZIP
Fun with InnerHTML & getAttribute. Be careful when using data-attribute...
Raw
gistfile1.js
var s = "<p data-foo=\"&lt;script&gt;alert('TEST')&lt;/script&gt;\">testing 123</p>";
document.body.innerHTML = s;
document.getElementsByTagName('p')[0].getAttribute('data-foo');
// => "<script>alert('TEST')</script>"
var s = "<p data-foo=\"\<script\>alert('TEST')&lt;/script&gt;\">testing 123</p>";
document.body.innerHTML = s;
document.getElementsByTagName('p')[0].getAttribute('data-foo');
// => "<script>alert('TEST')</script>"
var s = '<p data-foo="' + "<script>alert('TEST')</script>" + '">testing 123' + '</p>';
document.body.innerHTML = s;
document.getElementsByTagName('p')[0].getAttribute('data-foo');
// => "<script>alert('TEST')</script>"
var s = "<p>testing 123</p>";
document.body.innerHTML = s;
document.getElementsByTagName('p')[0].setAttribute('data-foo', "&lt;script&gt;alert('TEST')&lt;/script&gt;");
document.getElementsByTagName('p')[0].getAttribute('data-foo');
// => "&lt;script&gt;alert('foo')&lt;/script&gt;"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment