Javascript functions embedded in arguments run automatically?
<p>I am investigating defending against various types of attacks and I've found one I don't quite understand.</p>

<p>I have the following html:</p>

<pre><code>&lt;body onload="foo(''/alert(/Gotcha/)/'');"&gt;
&lt;script&gt;
   function foo(){
      alert("Inside Foo");
   }
&lt;/script&gt;
&lt;/body&gt;
&lt;/html&gt;
</code></pre>

<p>If you run this, you'll see an alert that says "/Gotcha/" followed immediately by one that says "Inside Foo".</p>

<p>What's going on?  Why is the alert in the argument (that foo doesn't even have) running?</p>

<p>What's more, if I remove any of those slashes or single-quotes in the argument, it doesn't work. </p>

<p>if I change it to </p>

<pre><code>&lt;body onload="foo('/alert(/Gotcha/)/');"&gt;
</code></pre>

<p>All I get is "Inside Foo".</p>

<p>if I change it to </p>

<pre><code>&lt;body onload="foo('/alert(Gotcha)/');"&gt;
</code></pre>

<p>or remove any of the /s I don't get anything.  </p>

<p>What is it about the ' and the / that makes this work?</p>