Fun with InnerHTML & getAttribute. Be careful when using data-attribute...

gistfile1.js

var s = "<p data-foo=\"&lt;script&gt;alert('TEST')&lt;/script&gt;\">testing 123</p>";
document.body.innerHTML = s;
document.getElementsByTagName('p')[0].getAttribute('data-foo');
// =>  "<script>alert('TEST')</script>"


var s = "<p data-foo=\"\<script\>alert('TEST')&lt;/script&gt;\">testing 123</p>";
document.body.innerHTML = s;
document.getElementsByTagName('p')[0].getAttribute('data-foo');
// =>  "<script>alert('TEST')</script>"


var s = '<p data-foo="' + "<script>alert('TEST')</script>" + '">testing 123' + '</p>';
document.body.innerHTML = s;
document.getElementsByTagName('p')[0].getAttribute('data-foo');
// =>  "<script>alert('TEST')</script>"



var s = "<p>testing 123</p>";
document.body.innerHTML = s;
document.getElementsByTagName('p')[0].setAttribute('data-foo', "&lt;script&gt;alert('TEST')&lt;/script&gt;");
document.getElementsByTagName('p')[0].getAttribute('data-foo');
// => "&lt;script&gt;alert('foo')&lt;/script&gt;"