Code:
<script>
function f(input) {
retu '<article>' + input + '</article>';
}
document.write(f('<script>alert(1)</script>')); //alert 1
document.write(f('<script>alert(1)</script>')); // write normal text
</script>
In my idea, <script>alert(1)</script> is the same as <script>alert(1)</script>(the raw vs http entity codes), but it results different result, could any body explain about that?
