470,630 Members | 1,637 Online
Bytes | Developer Community
New Post

Home Posts Topics Members FAQ

Post your question to a community of 470,630 developers. It's quick & easy.

How to dynamic append and run a javascript in a section of HTML?

e.g.
<div id="test">

test

</div>
<script>

document.getElementById("test").innerHTML
='<script>alert(1);</sc'+'ript>';

</script>

how to make the code run at the DIV - test ?

thanks.

Dec 7 '06 #1
2 1252
howa wrote:
e.g.

<div id="test">
test
</div>
<script>
document.getElementById("test").innerHTML
='<script>alert(1);</sc'+'ript>';
</script>

how to make the code run at the DIV - test ?
There has just been an extensive thread on this very subject, although
the title may not indicate it:

<URL:
http://groups.google.com.au/group/comp.lang.javascript/browse_frm/thread/7e23f42490c301de/f97dcd8d723274f7#f97dcd8d723274f7>

Essentially the most cross-browser way is to strip out the script
elements and eval their content. There are other (possibly better)
methods that may become viable in the future, but for now eval() seems
to be the best bet.

Note that it may have unexpected effects on the scope of declared
variables, ensure you understand what they are before doing anything
non-trivial.

You might like to try the FORK library's Mutate function which does
most of the hard work for you:

<URL: http://forkjavascript.org/ >

<script type="text/javascript" src="mutate.js"></script>

<div id="test">test</div>

<script type="text/javascript">
FORK.Mutate.insertBottom(
'test',
'<script type="text/javascript">alert(1);<\/script>'
);
</script>
--
Rob

Dec 7 '06 #2
In comp.lang.javascript message
<11*********************@16g2000cwy.googlegroups.c om>, Wed, 6 Dec 2006
23:27:12, RobG <rg***@iinet.net.auwrote:
>
There has just been an extensive thread on this very subject, although
the title may not indicate it:
For those with good off-line newsreaders, it would be helpful to give
such Titles.

--
(c) John Stockton, Surrey, UK. REPLYyyww merlyn demon co uk Turnpike 6.05.
Web <URL:http://www.uwasa.fi/~ts/http/tsfaq.html-Timo Salmi: Usenet Q&A.
Web <URL:http://www.merlyn.demon.co.uk/news-use.htm: about usage of News.
No Encoding. Quotes precede replies. Snip well. Write clearly. Mail no News.
Dec 7 '06 #3

This discussion thread is closed

Replies have been disabled for this discussion.

By using this site, you agree to our Privacy Policy and Terms of Use.