CODEWITHSUNDEEP
javascriptjspescaping
Hardik Mishra
Hardik Mishra

Reputation: 14897

Escape single quote with JavaScript

I am aware with escaping special characters in HTML.

But, I am still asking this as I have come across a situation.

I have a JSP, in which I am not allowed put validation on input. Users are entering special characters to test.

Input string:

'#@$%

When I am displaying from database, I am using

<%= StringEscapeUtils.escapeHtml(map[i].get("text").toString())%>

where "map" is an array of Hashmap. This works fine.

The problem comes when I need to pass this string to JavaScript using

<input type="Button"
onclick="onEdit('<%= StringEscapeUtils.escapeHtml(map[i].get("text").toString())%>',
'<%= strShortCut%>','<%= map[i].get("uid")%>')" value="Edit">

The string becomes ''#@$%'.

How do I escape a single quote?

Upvotes: 2

Views: 1281

Answers (3)

George_A
George_A

Reputation: 361

You can use:

<c:set var="escapedVar">
  <spring:eval expression="unescapedVar" javscriptEscape="true"/>
</c:set>

Upvotes: 0

Moody Ibrahim Moody
Moody Ibrahim Moody

Reputation: 35

Just prepend every single quote with a backslash. Like the following: StringEscapeUtils.escapeHtml(map[i].get("text").toString()).replace("\'","\\'")

But your problem is not only in the single quote. There is also the double quote (") and the backslash itself (\).

Use the same technique as shown before. You can also use regular expressions, but I showed you the simplest way.

To check the escape characters, look at the URL http://docs.oracle.com/javase/tutorial/java/data/characters.html.

Upvotes: 0

Jigar Pandya
Jigar Pandya

Reputation: 5987

If you would be using Java, maybe you can do the below in Java.

import org.apache.commons.lang.StringEscapeUtils;
...

String result = StringEscapeUtils.escapeJavaScript(jsString);

Upvotes: 1

Related Questions