Character data interpreted in XHTML

[Patrick-ring-motive]

script tags are interpreted as CDATA in typical html but in xhtml characters are interpreted using the standard syntax so for example, < and & are represented by < and &. You may think this is irrelevant in modern web because nobody uses xhtml but they do. Any time a script tag is nested inside an svg tag, it is interpreted as xhtml. See this example:

<script type="module">
    const gt = 5;
    const test = 5 &gt; + 7;
    console.log(+test); // > 5
</script>
<svg>
  <script type="module">
    const gt = 5;
    const test = 5 &gt; + 7;
    console.log(+test); // > 0
  </script>
</svg>

In the first script test is set to 5 & gt which is 5 & 5 resulting in 5. In the second script > is converted to > so test is set to 5 > +7 which is false. Then +test is coerced into 0.

[Harsha2614]

This behavior happens because <script> inside is parsed as XML/XHTML, not HTML. In XML, character entities like > are decoded before the JS engine runs, while in normal HTML script tags they are treated as raw text (CDATA-like behavior).

So in the SVG case, > becomes > before execution, changing the logic. This can easily cause subtle bugs when embedding scripts inside SVG.

A possible workaround is to avoid HTML entities inside SVG scripts and use > directly, or move logic outside the SVG context when possible.

[Patrick-ring-motive]

@Harsha2614 I ended up making my own repo for weird quirks like this https://github.com/Patrick-ring-motive/Forbidden-Techniques-JS