html - src 是否应该在 HTML 的脚本标签中进行 HTML 转义？

Question

给定这样的代码:

<script src="http://example.com/?foo=1&amp;bar=2"></script>

src 的值是否应该如图所示进行 HTML 转义？

我的实验和研究显示出模棱两可的结果。

Answer 1

是的。如果您有疑问，可以使用 W3C validator ，表示 & 在这种情况下必须转义为 &。

双引号属性根据this rules解析.当找到 & 时，

Switch to the character reference in attribute value state, with the additional allowed character being U+0022 QUOTATION MARK (").

还有 Character reference in attribute value state包含在

Attempt to consume a character reference.

If nothing is returned, append a U+0026 AMPERSAND character (&) to the current attribute's value.

Otherwise, append the returned character tokens to the current attribute's value.

Finally, switch back to the attribute value state that switched into this state.

因此，如果您不对 & 进行转义，它(可能)也会起作用。但是，它会在 consumption of the character reference 期间产生一个解析错误。 :

If no match can be made, then no characters are consumed, and nothing is returned. In this case, if the characters after the U+0026 AMPERSAND character (&) consist of a sequence of one or more alphanumeric ASCII characters followed by a U+003B SEMICOLON character (;), then this is a parse error.

注意如果你想安全的话你应该转义它:

Certain points in the parsing algorithm are said to be parse errors. The error handling for parse errors is well-defined (that's the processing rules described throughout this specification), but user agents, while parsing an HTML document, may abort the parser at the first parse error that they encounter for which they do not wish to apply the rules described in this specification.