thanks to both for the quick replies

wow - what a minefield this has turned out to be !!

i previously had just one server-side utility function to escape a string as 
a literal javascript string. now i realise i need to have 2 separate 
functions, one for when the javascript literal is to be placed inside an 
HTML attribute value (e.g. onclick="...") and a different one for when it is 
inside a script block, because one is CDATA and one is PCDATA

Andy


"Martin Honnen" <mahotrash@y...> wrote in message 
news:4843e357$0$27438$9b4e6d93@n......
> Andy Fish wrote:
>
>> can someone point me at part of the w3c specification that states how 
>> script tags are parsed differently to other tags in HTML.
>
> See http://www.w3.org/TR/html4/types.html#type-script:
>   "Please note that script data that is element content may not contain 
> character references, but script data that is the value of an attribute 
> may contain them."
> and http://www.w3.org/TR/html4/appendix/notes.html#notes-specifying-data:
>   "The DTD defines script and style data to be CDATA for both element 
> content and attribute values. SGML rules do not allow character references 
> in CDATA element content but do allow them in CDATA attribute values."
>
>> interestingly i have also discovered that this:
>>
>> <script>if (3<5);</script>
>>
>> IS valid html and seems even to be valid XHTML even though it is not 
>> valid XML
>
> That snippet is not well-formed so it can't be valid XML or XHTML as it is 
> not even XML.
>
>
> -- 
>
> Martin Honnen
> http://JavaScript.FAQTs.com/