I have a data object: var o_Data =new Object(); o_Data.title ='<script>alert("1");</script>'; o_Data.value ='3'; When i used JSON.stringify(o_Data), then put in to value of input tag <input value=\'' + JSON.stringify(o_Data) + '\' type="radio" name="data" class="hide"/> I don't understand why Actual Result: Expected Result:
try to add escape function <input value=\'' + escape(JSON.stringify(o_Data)) + '\' type="radio" name="data" class="hide"/> Code (markup):
have you tried creating an element via DOM? var o_Data =new Object(); o_Data.title ='<script>alert("1");</script>'; o_Data.value ='3'; var input = document.createElement('input'); input.type = "radio"; input.name = "data"; input.className = "hide"; input.value = JSON.stringify(o_Data); document.getElementById("the_container").appendChild(input); // the_container is the ID of the element where you want the radio button to be placed inside Code (markup):