title: escaping: "var name = '</script>'"
body: <p>our middle tier needs to do something to prevent <code>&lt;/script&gt;</code> from appearing verbatim in javascript string. for example, in all browsers, the HTML parser in its first pass will ignore the javascript context, see the first close-script, then see garbage then see a second close-script. See: <a href="http://www.wwco.com/~wls/blog/2007/04/25/using-script-in-a-javascript-literal/" rel="nofollow">using-script-in-a-javascript-literal</a></p>
  
  <pre><code>&lt;HTML&gt;
  &lt;BODY&gt;
    start
    &lt;SCRIPT&gt;
      alert( "&lt;/SCRIPT&gt;" );
    &lt;/SCRIPT&gt;
    finish
  &lt;/BODY&gt;
  &lt;/HTML&gt;
  </code></pre>
  
  <p>My first idea to fix this is to extend the characters we escape for javascript strings to include '>' and '&lt;' -- this appears to work in the browsers I tested, but doesn't look standards compliant: <a href="http://www.javascriptkit.com/jsref/escapesequence.shtml" rel="nofollow">escapesequence.shtml</a></p>
  
  <p>edit: this rule is specifically for contents rendered into a javascript string literal.</p>