Deprecated JavaScript APIs: document.write, escape() and Inline Handlers

What bseoa flags

bseoa scans the page's script content for these patterns and reports each one it finds, along with the suggested replacement:

• document.write: use DOM methods instead.
• escape(: use encodeURIComponent().
• unescape(: use decodeURIComponent().
• onload= and onclick=: use addEventListener().

The check matches text, so a method with a similar name, such as CSS.escape(, is also reported. CSS.escape() is a modern API and can be left alone.

document.write

document.write injects markup into the HTML parser while the page is loading. When it adds a parser-blocking external script, the browser has to stop, fetch and run that script before continuing. Chrome can block cross-site scripts inserted this way on slow connections, so the code may simply not run for some visitors. Called after the page loads, it replaces the whole document.

// Before
document.write('<script src="https://cdn.example.com/widget.js"><\/script>');

// After
const s = document.createElement('script');
s.src = 'https://cdn.example.com/widget.js';
s.async = true;
document.head.appendChild(s);

If the call comes from a third-party tag, check whether the vendor offers an async snippet.

escape() and unescape()

These are legacy functions kept only for backward compatibility. They don't handle non-ASCII characters the way URLs expect, so values with accents or emoji get mangled.

// Before
const q = escape(searchTerm);

// After
const q = encodeURIComponent(searchTerm);
const original = decodeURIComponent(q);

Inline onload= and onclick= handlers

Inline event attributes aren't removed from browsers, but they mix behavior into markup and require 'unsafe-inline' or 'unsafe-hashes' in a Content Security Policy. Attaching listeners in script keeps a strict CSP possible:

<!-- Before -->
<button onclick="openDemo()">Watch demo</button>

<!-- After -->
<button id="demo-button">Watch demo</button>
<script>
  document.getElementById('demo-button')
    .addEventListener('click', openDemo);
</script>