问题
I need a list of all of the attributes that can accept inline JS. (yes, I would count the href tag as such an attribute due to the javascript: ability).
I have been googling around for this quite a bit, but thus far, only results relating to "why you shouldn't use inline JS". I've even tried finding a list of HTML5 attributes period. I managed to find a list for HTML4 (http://www.w3.org/TR/html4/index/attributes.html), so I have all of the HTML4 inline-code attributes...
However, I have no idea if HTML5 introduced any NEW attributes that use inline js. Any ideas?
EDIT: I am sorry -- I failed to make this clear:
I am not trying to use inline JS -- I am trying to stop others from using it.
I am working on a project for a website which has gone years without any sort of filtered HTML whatsoever. We have gone through attack after attack. I have finally convinced the website's creator to let me create a function that will filter out all JS from the HTML. I finished this only to find out that I had completely forgotten about inline JS. I would like a comprehensive list of all inline JS attributes so that I may stop them as well.
EDIT: Thanks to Joe Johnson's great answer, I've found numerous resources for those who are also interested in a complete list of attributes:
HTML4 event attributes:
http://dev.w3.org/2006/webapi/DOM-Level-3-Events/html/DOM3-Events.html#events-module (Thanks joe!)
http://www.w3.org/TR/html4/index/attributes.html
HTML5 new event attributes:
http://www.w3schools.com/html5/html5_ref_eventattributes.asp
Browser-Specific attributes:
iOS:http://developer.apple.com/library/ios/#documentation/AppleApplications/Reference/SafariWebContent/HandlingEvents/HandlingEvents.html
IE:reference.sitepoint.com/html/extended-event-attributes
Firefox:developer.mozilla.org/en-US/docs/Gecko-Specific_DOM_Events
回答1:
As far as I'm aware, there are no new attributes which accept javascript: protocol (such as href) or inline JS outside of event handlers. However, HTML5 has introduced many new event handlers (on[click,mouseenter,mouseleave,etc] -- these are not new however, just examples).
I hate to beat a dead horse here... but, everything you've found is hitting the nail on the head -- try to avoid inline JS.
回答2:
Why use an out-dated technique on blistering new technology?
Old inline js still works on all html5 elements: HTML4 inline on HTML5 element but DONT!
Event the new html5 events work inline http://www.w3schools.com/html5/html5_ref_eventattributes.asp
HTML5 inline with new HTML5 event on HTML5 element
来源：https://stackoverflow.com/questions/12306543/what-are-all-of-the-inline-js-attributes-new-in-html5