How to fix the whacky <script></script> bug in C# when dynamically creating javascript.



So I spent ages trying to work out what the problem was with my code
when I did this and found a post which led me to the very simple
solution.

I use WebMatrix so I'm not sure if this is a major problem in VS or not
but it is bloody frustrating.

Stick the following bit of code into a page and save it.

<%@ Page Language="C#" %>
<script runat="server">
private void Page_Load( object sender, EventArgs e ) {
string scripttoadd = "<script></script>";
sometext.Text = scripttoadd;
}
</script>
<html>
<head>
</head>
<body>
<form runat="server">
<asp:Label id="sometext" runat="server"/>
</form>
</body>
</html>

So this is a pretty basic page and fairly often you'll want to add a
dynamically created script to the page to do something on the client
side...

If you try and execute this however you will get the error:

CS1010: Newline in constant

This stumped me for ages as I couldn't find the newline anywhere.
Removing the second > seemed to fix the problem but led to errors in
the HTML later on - especially where there were other scripts in the
page.

A chance post where someone mentioned the interpreter getting mangled
on something else and the colours all disappearing on the rest of my
code in WebMatrix made me realise that this is exactly what is going on
as you can't have nested <script> tags according to the the HTML spec -
and the IDEs and Interpreter don't look at the surrounding "" to see
whether you are really building a tag or not.

As such the solution if anyone else gets into this particular pickle is
to change this line:

string scripttoadd = "<script></script>";

to this line:

string scripttoadd = "<script></script" + ">";

and it will all work fine - no tripping up - I promise.

AndrewF

.



Relevant Pages

  • [Full-Disclosure] Multiple XSS vulnerabilites in PHPNuke
    ... Yes, more XSS in phpnuke... ... PHP-Nuke's rdf/rss parser doesn't strip html tags when parsing RSS files. ... strips <script> tags, it allows for events on tags. ...
    (Full-Disclosure)
  • Re: Enable script in HTTPWebRequest
    ... It would help if you posted the actual HTML you receive. ... The reason is that there is probably a script in the page that writes out ... > have when i use a browser, to parse some data from the page. ... Answer from the page is (without HTML tags): ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Navigating text string that contains HTML of a page as DOM object?
    ... with AJAX I will get a remote web page into a string. ... The first question is why are you sending more HTML to the client than is necessary? ... Remove script tags & content - necessary to cut down ...
    (comp.lang.javascript)
  • Re: Most efficient ebook format and fastest reader?
    ... The html tags supported by the ... The second option is to write a quick script to rip out the offending tags. ... but this one is still darn current for a general purpose encyclopedia.). ...
    (microsoft.public.pocketpc)
  • Cant make this page work
    ... I can't make this script work properly. ... The script at the bottom of the html page ... Does someone have a perl ... sub output_trace_headers { ...
    (comp.lang.javascript)

Loading