Reputation: 1
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<title>Insert title here</title>
<script type="text/javascript">
var ts='';
function test(value1)
{
// this works when the value1 is a number only but if value1 is a string is does not work
var optionsVal = ' ';
optionsVal= '<input type="button" onclick="postRun('+value1+')" value="test" /> ';
document.getElementById('test').innerHTML = optionsVal;
}
function postRun(km)
{
alert(km);
}
</script>
</head>
<body>
<%
String ss="Click Me";
%>
<input type="button" onclick="test('<%=ss%>')" value="Click me" />
<div id="test"></div>
</body>
</html>
Upvotes: 0
Views: 200
Reputation: 393
Yes, this is because your embedded code is not escaped in the output. Use JSON:
optionsVal= '<input type="button" onclick=\'postRun('
+ JSON.stringify(value1)
+ ')\' value="test" />';
Upvotes: 1