Sorry, deleted that comment before I saw your reply. As I read the whole article I realized that I had nothing interesting to add to it. :)

And absolutely, CDATA is a solution for that scenario.

For the curious, what I blurted out before reading the whole thing:

HTML rules where the script is, of course it would also decide where it ends -- without having to parse the javascript. As for XSS, if you are vulnerable to this one, you are probably vulnerable to other nifty tricks as well.

If you -really- need to use the /script tag, then most people know that the cheap hack is to just: alert("</scr"+"ipt>");

Best solution is just to put the javascript in another file. Barring that, escape your javascript. Replace < with &lt;, etc. I am not sure CDATA exists in HTML (I seem to remember it being something for XML and DTDs).

But surely the CDATA tag is vulnerable to the string "]]>" appearing embedded somewhere in the code?