Stop executing JavaScript

Question

I have:

$('body').data('data1', '<script type="text/javascript">console.debug('execute');</script><div>example</div>');

and:

<div id="content"></div>

when I do:

$(document).ready(function () {
    $('#content').html($('body').data('data1'));
});

then JavaScript is executed. How to prevent executing? Is it possible?

Actually, you get a syntax error. And even if you fix that, what did you expect to happen? If you don't want a script to run, then why are you inserting it into the DOM? — Lightness Races in Orbit
– Lightness Races in Orbit, Commented May 28, 2011 at 2:01
Sorry for this syntax error. I was writing from memory. This example is the sample of a large problem. Just I must also store JS codes. — Paweł Walaszek
– Paweł Walaszek, Commented May 28, 2011 at 2:10

Félix Saparelli · Accepted Answer · 2011-05-28 02:21:46Z

1

You have to strip the script tags from your HTML string.

var p = new DOMParser(),
    doc = p.parseFromString("<html><body>...</body></html>", "text/xml");
$('script', doc).remove();

This works with Firefox/Chrome, although I don't know about other browsers. Note this will only work with well-formed (x)html.

EDIT: If you also want the JS, you can amend the previous code thus:

var scripts = [];
$('script', doc).remove().each(function() {
  scripts.push($(this).html());
});

Mind you, you don't even have to remove the script tags. Now that the response is in its separate DOM document, it will not mess up your own scripts, and you can access whatever content you need from it using easy $('selector', doc) jQuery.

edited May 28, 2011 at 2:21

answered May 28, 2011 at 2:08

Félix Saparelli

8,7596 gold badges55 silver badges68 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Daniel · Accepted Answer · 2011-05-28 02:11:39Z

0

The only way you are going to stop the script from executing is to remove it from your data. The prototype framework does this using a regular expression like below:

  <script[^>]*>([\\S\\s]*?)<\/script>

answered May 28, 2011 at 2:11

Daniel

4,9771 gold badge26 silver badges19 bronze badges

3 Comments

Félix Saparelli Over a year ago

Hmm, don't parse HTML with Regex? Please?

Daniel Over a year ago

I know it is nasty. However it works quite well. It is copied straight from the prototype source code. Doing it this way means that will work with malformed XHTML and will also work in all browsers.

Paweł Walaszek Over a year ago

Good idea. I have removed these tags, but an another way.

Collectives™ on Stack Overflow

Stop executing JavaScript

2 Answers 2

Comments

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related