Please read this statement carefully: let\'s assume before ANY elements are added to the document
all unsafe elements in $dom have
It seems that the script will not work as long as it is not appended to DOM.
$(function ()
{
var ss = document.createElement('script');
var scr = 'alert("bah");';
var tt = document.createTextNode(scr);
ss.appendChild(tt);
var hh = document.getElementsByTagName('head')[0];
//hh.appendChild(ss);
});
And
$(function ()
{
var ss = document.createElement('script');
var scr = 'alert("bah");';
var tt = document.createTextNode(scr);
ss.appendChild(tt);
var hh = document.getElementsByTagName('head')[0];
hh.appendChild(ss);
});