Howdy,

First off, I should say that I am jumping on posting this issue much quicker than I normally would - but I'm not really in a patient mood now, and I'm far from being a fan of anything the W3 has done.

Anyhow, I am in the process of going through a CMS I've built the past decade and cleaning up its markup so it validates (XHTML Strict).

I've run into a little hitch and was wondering if there is a simple solution, or if this is another one of the many restrictions XHTML seems to impose.

I understand the whole concept of encoding ampersands - that isn't news to me.

My problems lies within JavaScript which is directly placed within the XHTML markup, and doesn't reside in a JavaScript specific file.

For example, here is some JavaScript residing within the markup (which I understand to be valid):

<script type='text/javascript'>initializeRefresh('ajaxdata.php?type=my_status&u=x&mode=x&showmore=x', 15,'MyStatusMessagePane');</script>

... there I have NOT encoded the ampersands, because as context would dictate, ampersands shouldn't be encoded when in a JavaScript context - correct?

Well, the validator throws a fit over it and spits out many errors and warnings over this usage, despite being allowed to hold JavaScript within your markup.

So if I change the code to look more like:

<script type='text/javascript'>initializeRefresh('ajaxdata.php?type=my_status&amp;u=x&amp;mode=x&amp;showmore=x', 15,'MyStatusMessagePane');</script>

... the validator DOESN'T complain, but the JavaScript code is broken, as the incorrect URL is parsed and loaded. Obviously, I know I could just go into the JavaScript function and replace encoded ampersands with the character itself, but this isn't a solution in my opinion, because it only hides the problem and doesn't address the cause.

This same situation occurs in a more common use of JavaScript like so:

<span onclick="window.location.href='';">blah</span>

That code would fail validation, but function properly; yet if you encode the ampersand, it will validate, but won't work!

So, what's up here? I'll either slap myself for missing something so silly, or I'll add more fuel to my already roaring fire against W3. >_<

Surely there has got to be a practical approach here - to appease both ends - that I've just overlooked or haven't been aware of.

I appreciate any information any of you guys and gals may have!

Thanks for your time.

Dani AI

Generated

As discovered, the validator errors come from XML parsing rules, not a bug in JavaScript. In XML (and therefore in XHTML when it is actually parsed as XML) the characters & and < are markup delimiters and must either be escaped or placed inside a CDATA section; otherwise the XML parser flags well-formedness errors. See the XML spec for the rule. (W3C XML 1.0). (w3.org)

Whether you see runtime breakage or just validator warnings depends on how the page is served. Pages served as text/html are parsed with the HTML parser (script/style are treated as raw text there), so unescaped & often "works" in browsers even though it would fail XML parsing. Pages served as application/xhtml+xml use an XML parser and require escaping or CDATA. The validator enforces the XML/XHTML rules if you are validating as XHTML, so choose your Content-Type and validation target deliberately. (MDN: XHTML; W3C: Serving XHTML). (developer.mozilla.org)

Practical fixes and caveats: CDATA wrapped around inline scripts is the normal XML-safe solution and is what used; it prevents the XML parser from treating & and < as markup. If the same file is also served as text/html, it is common to hide CDATA markers from JavaScript engines with comment wrappers so the code runs in both modes. CDATA cannot contain the sequence ]]> and double-escaping (for example producing &amp;amp;) is what actually breaks URLs — avoid double-encoding. For compatibility patterns and notes see the polyglot/XHTML guidance. (developer.mozilla.org)

Best practice: prefer external JS or place server-generated URLs into data attributes or JSON (so the serializer handles quoting), keep inline-event handlers minimal, and ensure your server actually sends the MIME type you intend. If you do want strict XHTML parsing, use CDATA (or properly escape entities) and test both validation and runtime; if not, consider validating/serving as HTML5 to avoid unnecessary XML constraints (as hinted by using Transitional). (w3.org)

Recommended Answers

All 3 Replies

I figured it out eventually - I told you I posted this a bit prematurely! ;)

I thought I'd follow up with the solution though in case someone else stumbles on this thread and needs to know what you gotta do.

From a lot of the threads I read about this, most give the typical easy solutions that aren't thought through properly (like "der, put all the code in an external javascript"), so it was hard to find someone who actually knew the real fix:

CDATA!

I've seen "CDATA" appear a few times before but never really knew what it was used for in detail. It turns out, it is used for things like this:

<script type='text/javascript'><![CDATA[ initializeRefresh('ajaxdata.php?type=my_status&u=x&mode=x&showmore=x', 15,'MyStatusMessagePane'); ]]></script>

Using this allowed the autorefresh mechanism work again AND it checked out as validated. I have yet to test its use INSIDE another tag like in an "onclick" - so, I can't vouch for if that works (though I did notice that those URLs are working in JavaScript fine even with encoded ampersands).

I use xhtml transitional. Strict, nada. I have great luck with w3, just importing other people's code through php shows errors all the time. I wish "other people" were as conscientious as you and me.

Nah, it's not that I have bad luck with the W3; it's that I don't agree with a lot of how the W3 standardizes things, and I often feel they are holding web development back by evolving way too slowly, and often are changing based on what the companies who endorse them think is best. What I basically mean is that it's taken CSS 10 years to finally get support for such basic concepts (and even then they aren't completely standardized yet, and we still have to nest elements like nobody's business to achieve basic presentation). I've been designing sites for like 12 years now, and I really don't think markup has improved a fraction as much as I think it should have. Things have gotten a whole lot less lax and more anal about how you do things, but it feels like a lot of the "new" stuff, is really just a new way of doing something you could do before. I know I won't win many popularity votes by saying this, considering how in love so many web developers are with the W3, but I don't think they do a good job at setting standards to say the least. >_<

But I do agree with you that anyone who plans to distribute their code should be more conscientious, as I also deal with just what you've described if I attempt to try someone else's code.

XHTML strict really doesn't seem to be much more troublesome than using transitional - there are a few quirks you gotta learn to live with, but when you are aware of them it's pretty easy to go strict.

Thanks for your post!

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.