bpletzer/document_write_while_writeCapture.html Secret

## document_write_while_writeCapture.html
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"
      dir="ltr" id="html">
<head>
    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
    <title>404 different domain</title>

    <script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.js"></script>
    <script src="writeCapture.js" type="text/javascript" charset="utf-8"></script>
    <script src="jquery.writeCapture.js" type="text/javascript" charset="utf-8"></script>

    <style>
    div {
        border: 1px solid black;
    }
    </style>

</head>
<body>

    <h1>document.write while capturing get messed up</h1>

    <div id="one">
        <script type="text/javascript">
        var one = '<scr'+'ipt src="http://some.domain/js.php?r='+ Math.random() +'" type="text/javascript" charset="utf-8"></scr'+'ipt>';
        $('#one').writeCapture().html(one);
        </script>
    </div>
    <div id="two">
        <script type="text/javascript">
        document.write('directly written');
        </script>
    </div>

    <div id="footer">fin</div>
</body>
</html>

## js.php
<?php
header('Content-type: text/javascript');

if (isset($_GET['sleep']) and is_numeric($_GET['sleep'])) {
  sleep($_GET['sleep']);
} else {
  sleep(1);
}

if (isset($_GET['js'])) {
  echo $_GET['js'];
} else {
  echo <<<JS
document.write('js');
JS;
}
	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
	<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"
	dir="ltr" id="html">
	<head>
	<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
	<title>404 different domain</title>

	<script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.2/jquery.js"></script>
	<script src="writeCapture.js" type="text/javascript" charset="utf-8"></script>
	<script src="jquery.writeCapture.js" type="text/javascript" charset="utf-8"></script>

	<style>
	div {
	border: 1px solid black;
	}
	</style>

	</head>
	<body>

	<h1>document.write while capturing get messed up</h1>

	<div id="one">
	<script type="text/javascript">
	var one = '<scr'+'ipt src="http://some.domain/js.php?r='+ Math.random() +'" type="text/javascript" charset="utf-8"></scr'+'ipt>';
	$('#one').writeCapture().html(one);
	</script>
	</div>
	<div id="two">
	<script type="text/javascript">
	document.write('directly written');
	</script>
	</div>

	<div id="footer">fin</div>
	</body>
	</html>
	<?php
	header('Content-type: text/javascript');

	if (isset($_GET['sleep']) and is_numeric($_GET['sleep'])) {
	sleep($_GET['sleep']);
	} else {
	sleep(1);
	}

	if (isset($_GET['js'])) {
	echo $_GET['js'];
	} else {
	echo <<<JS
	document.write('js');
	JS;
	}