动态注入js脚本时出现意外的字符串错误

时间:2014-08-08 01:03:36

标签: javascript string escaping syntax-error code-injection

我需要以下列方式执行插入并执行javaScript:

$("body").append("<script>//Some Code</script>");

我尝试过两种编码方法

  1. 手动将所有内容移至同一行,并使用搜索替换所有双引号并使用单引号替换

    Fiddle:http://jsfiddle.net/benPearce/vaxo00eb/
    
  2. String使用stringescape_tool

  3. 转义javaScript

    这两种方法都会导致&#34;意外的字符串&#34;语法错误。如果有人能帮助我,我将非常感激!

    我需要注入的脚本

      seal_gif_url="images/nortonseal.gif";
    
    
      dn="www.mysite.com";
      sap="getnortonsealimage.js";
      splash_url="https://trustsealinfo.verisign.com";
      tpt="transparent";
    
      language="en";
      u1=splash_url+"/splash?form_file=fdf/splash.fdf&dn="+dn+"&lang="+language;
    
      function vrsn_splash() {
        tbar = "location=yes,status=yes,resizable=yes,scrollbars=yes,width=560,height=500";
        sw = window.open(u1,'VRSN_Splash',tbar);
        sw.focus();
      }
    
      {
        var ver=-1;
        var v_ua=navigator.userAgent.toLowerCase();
        var re=new RegExp("msie ([0-9]{1,}[\.0-9]{0,})");
        if (re.exec(v_ua) != null)
         ver = parseFloat( RegExp.$1 );
        var v_old_ie=(v_ua.indexOf("msie")!=-1);
        if (v_old_ie) {
         v_old_ie = ver < 5;
        }
    
        function maction(e){
          if (document.addEventListener) {
            var seal=(e.target.name=="seal");
            if (seal) { vrsn_splash(); return false; }
          } else if(document.captureEvents) {
            var tgt=e.target.toString(); 
            var seal=(tgt.indexOf("splash")!=-1);
            if (seal){ vrsn_splash(); return false; }
          }
          return true;
        }
    
        function mouseDown() {
          if (event.button==1){
            if (v_old_ie) { return true; } else { vrsn_splash(); return false; }
          } else if (event.button==2) { vrsn_splash(); return false; }
        }
    
        document.write("<a HREF=\""+u1+"\" tabindex=\"-1\" onmousedown=\"return mouseDown();\" target=\"VRSN_Splash\"><IMG NAME=\"seal\" BORDER=\"true\" SRC=\""+seal_gif_url+"\" oncontextmenu=\"return false;\"></A>");
    
        if((v_ua.indexOf("msie")!=-1) && (ver>=7)) {
          var plat=-1;
          var re=new RegExp("windows nt ([0-9]{1,}[\.0-9]{0,})");
          if (re.exec(v_ua) != null)
            plat = parseFloat( RegExp.$1 );
    
          if (plat >= 5.1) {
           document.write("<div style='display:none'>");
           document.write("<img src='https://extended-validation-ssl.verisign.com/dot_clear.gif'/>");
           document.write("</div>");
          }
        }
    
        if (document.addEventListener){ 
          document.addEventListener('mouseup', maction, true); 
        } else {
          if (document.layers){
            document.captureEvents(Event.MOUSEDOWN); document.onmousedown=maction;
          }
        }
    
        function resized(){
          if(pageWidth!=innerWidth || pageHeight!=innerHeight){
            self.history.go(0);
          }
        }
    
        if(document.layers){
          pageWidth=innerWidth; pageHeight=innerHeight; window.onresize=resized;
        }
      }
    

3 个答案:

答案 0 :(得分:0)

尝试:

$("body").append($("<script>", {
    text: "//Some code"
}));

字符串中的</script>被解释为包含jQuery代码的Javascript的结尾。

问题出在脚本体的代码中。这条线有引用问题:

document.write('<img src='https://extended-validation-ssl.verisign.com/dot_clear.gif'/>');

它应该是:

document.write('<img src=\\'https://extended-validation-ssl.verisign.com/dot_clear.gif\\'/>');

我认为在这一行中加倍反斜杠也是必要的:

document.write('<a HREF=\''+u1+'\' tabindex=\'-1\' onmousedown=\'return mouseDown(); \' target=\'VRSN_Splash\'><IMG NAME=\'seal\' BORDER=\'true\' SRC=\''+seal_gif_url+'\' oncontextmenu=\'return false; \'></A>');

您需要转义所有斜杠,因为此Javascript位于原始脚本中的带引号的字符串中。

答案 1 :(得分:0)

尝试逃避斜线。

<\/script>

另外......你打算在任何地方宣布这些变量? :P

seal_gif_url="images/nortonseal.gif";
dn="www.mysite.com";
sap="getnortonsealimage.js";
splash_url="https://trustsealinfo.verisign.com";
tpt="transparent";
language="en";
u1=splash_url+"/splash?form_file=fdf/splash.fdf&dn="+dn+"&lang="+language;

答案 2 :(得分:0)

不确定这背后的理论是什么,但是有一组不必要的括号,其中包含导致错误的代码块。请参阅下面更改的javaScript。

 seal_gif_url="images/nortonseal.gif";


  dn="www.mysite.com";
  sap="getnortonsealimage.js";
  splash_url="https://trustsealinfo.verisign.com";
  tpt="transparent";

  language="en";
  u1=splash_url+"/splash?form_file=fdf/splash.fdf&dn="+dn+"&lang="+language;

  function vrsn_splash() {
    tbar = "location=yes,status=yes,resizable=yes,scrollbars=yes,width=560,height=500";
    sw = window.open(u1,'VRSN_Splash',tbar);
    sw.focus();
  }


    var ver=-1;
    var v_ua=navigator.userAgent.toLowerCase();
    var re=new RegExp("msie ([0-9]{1,}[\.0-9]{0,})");
    if (re.exec(v_ua) != null)
     ver = parseFloat( RegExp.$1 );
    var v_old_ie=(v_ua.indexOf("msie")!=-1);
    if (v_old_ie) {
     v_old_ie = ver < 5;
    }

    function maction(e){
      if (document.addEventListener) {
        var seal=(e.target.name=="seal");
        if (seal) { vrsn_splash(); return false; }
      } else if(document.captureEvents) {
        var tgt=e.target.toString(); 
        var seal=(tgt.indexOf("splash")!=-1);
        if (seal){ vrsn_splash(); return false; }
      }
      return true;
    }

    function mouseDown() {
      if (event.button==1){
        if (v_old_ie) { return true; } else { vrsn_splash(); return false; }
      } else if (event.button==2) { vrsn_splash(); return false; }
    }

    document.write("<a HREF=\""+u1+"\" tabindex=\"-1\" onmousedown=\"return mouseDown();\" target=\"VRSN_Splash\"><IMG NAME=\"seal\" BORDER=\"true\" SRC=\""+seal_gif_url+"\" oncontextmenu=\"return false;\"></A>");

    if((v_ua.indexOf("msie")!=-1) && (ver>=7)) {
      var plat=-1;
      var re=new RegExp("windows nt ([0-9]{1,}[\.0-9]{0,})");
      if (re.exec(v_ua) != null)
        plat = parseFloat( RegExp.$1 );

      if (plat >= 5.1) {
       document.write("<div style='display:none'>");
       document.write("<img src='https://extended-validation-ssl.verisign.com/dot_clear.gif'/>");
       document.write("</div>");
      }
    }

    if (document.addEventListener){ 
      document.addEventListener('mouseup', maction, true); 
    } else {
      if (document.layers){
        document.captureEvents(Event.MOUSEDOWN); document.onmousedown=maction;
      }
    }

    function resized(){
      if(pageWidth!=innerWidth || pageHeight!=innerHeight){
        self.history.go(0);
      }
    }

    if(document.layers){
      pageWidth=innerWidth; pageHeight=innerHeight; window.onresize=resized;
    }