You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
<scriptsrc="/script.js"></script><script>alert('this should happen first')</script>
Then it gets "compiled" into this:
<scriptdefer>alert('this should happen second');</script><script>alert('this should happen first')</script>
But the defer attribute is invalid for inline scripts, so the code doesn't work the same way.
So, maybe, if the defer attribute is present, the script should be converted into a data URL like so:
<scriptsrc="data:text/javascript,alert('this should happen second');" defer></script><script>alert('this should happen first')</script>
This seems to be a common workaround when defer is wanted for an inline script. The double quotes within the script would need to be escaped, and multi-line attributes are valid (which is useful for readability), so the output could look something like this:
<scriptsrc="data:text/javascript, alert("this should happen second"); // more lines of code...
" defer></script><script>alert('this should happen first')</script>
The text was updated successfully, but these errors were encountered:
If the content of
script.js
is:and the content of our HTML file is:
Then it gets "compiled" into this:
But the
defer
attribute is invalid for inline scripts, so the code doesn't work the same way.So, maybe, if the
defer
attribute is present, the script should be converted into a data URL like so:This seems to be a common workaround when
defer
is wanted for an inline script. The double quotes within the script would need to be escaped, and multi-line attributes are valid (which is useful for readability), so the output could look something like this:The text was updated successfully, but these errors were encountered: