I was under the impression that all I needed to do to make inline JSON safe was to break any closing
</script> tags in strings, e.g. escape the
However I found a weird combination that still breaks my page. The text "Won't print" won't be output onto the page. The HTML comment alone is fine, the script tag alone is fine, but the combination of the two is lethal. Why is that?
<!DOCTYPE html> Before <script>"<script>"</script> fine <script>"<!--"</script> still fine <script>"<!--<a>"</script> fine again <script>"<!--<script>"</script> Won't print
Will display as "Before fine still fine fine again". "Won't print" will be treated as part of the script tag, which will be treated as unclosed.