Hacker News new | ask | show | jobs
by chrismorgan 315 days ago
> Imagine if script tags required HTML escaping:

There are two situations in which it does.

① XML syntax, which is absolutely still a thing:

  data:application/xhtml+xml,<html xmlns="http://www.w3.org/1999/xhtml"><script>console.log( 1 &gt; 0 &amp;&amp; 0 &lt; 1 )</script></html>
② Inside an SVG <script> element in HTML syntax:

  data:text/html,<svg><script>console.log( 1 &gt; 0 &amp;&amp; 0 &lt; 1 )</script></svg>