52,787
社区成员
发帖
与我相关
我的任务
分享
re = /<script.+?>(.+)<\/script>/i;
if(re.test(xmlHttp.responseText)) {
//alert("ok")
getObject(requestType).innerHTML=eval(xmlHttp.responseText.replace(re, "$1"));
}else
{
getObject(requestType).innerHTML = xmlHttp.responseText;
}
Response.Write "<script>var online= new Array();</script"+">"
Response.Write "<script src='http://webpresence.qq.com/getonline?Type=1&"&bxinxi(5)&":'></script"+">"
Response.Write "<script>if(online[0]==0){alert('sss');}else{document.write('ok');}</script"+">"
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title>innerHTML.html</title>
<meta http-equiv="keywords" content="keyword1,keyword2,keyword3">
<meta http-equiv="description" content="this is my page">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<script type="text/javascript">
window.onload = function () {
document.getElementById("show").innerHTML = "<script>alert('sssaabb');<\/script>";
};
</script>
</head>
<body>
<div id="show"></div>
</body>
</html>
没有结果,可见innerHTML不能放入出现script这种关键字。
解决方法就是返回动态的数据在js脚本中使用,不能在服务器端返回js脚本在innerHTML中使用。