CODEWITHSUNDEEP
javascriptdomescaping
cc young
cc young

Reputation: 20213

in javascript dom, escaping characters in querySelector()

I discovered that almost all non-alphanumeric characters must be quoted in querySelector() and querySelectorAll(). From my testing:

for( var i=32; i<127; i++ ) { 
   var ch = String.fromCharCode(i);
   try{ document.querySelector("[a"+ch+"b]") }
   catch(e) { console.log( i + ' = ' + ch ); }
};

Only "-" and "_" did not need to be escaped. This requires a specialized replace type function for arguments to querySelector to make sure they are filtered correctly. Other functions (eg, setAttribute, getAttribute) do not need escaping.

I am unable to find documentation to verify testing. For example, what about Unicode characters in an attribute name?

Upvotes: 2

Views: 1218

Answers (1)

Paul Sweatte
Paul Sweatte

Reputation: 24617

The selector grammar is as follows:

ident     [-]?{nmstart}{nmchar}*
name      {nmchar}+
nmstart   [_a-z]|{nonascii}|{escape}
nonascii  [^\0-\177]
unicode   \\[0-9a-f]{1,6}(\r\n|[ \n\r\t\f])?
escape    {unicode}|\\[^\n\r\f0-9a-f]
nmchar    [_a-z0-9-]|{nonascii}|{escape}
num       [0-9]+|[0-9]*\.[0-9]+
string    {string1}|{string2}
string1   \"([^\n\r\f\\"]|\\{nl}|{nonascii}|{escape})*\"
string2   \'([^\n\r\f\\']|\\{nl}|{nonascii}|{escape})*\'
invalid   {invalid1}|{invalid2}
invalid1  \"([^\n\r\f\\"]|\\{nl}|{nonascii}|{escape})*
invalid2  \'([^\n\r\f\\']|\\{nl}|{nonascii}|{escape})*
nl        \n|\r\n|\r|\f
w         [ \t\r\n\f]*

D         d|\\0{0,4}(44|64)(\r\n|[ \t\r\n\f])?
E         e|\\0{0,4}(45|65)(\r\n|[ \t\r\n\f])?
N         n|\\0{0,4}(4e|6e)(\r\n|[ \t\r\n\f])?|\\n
O         o|\\0{0,4}(4f|6f)(\r\n|[ \t\r\n\f])?|\\o
T         t|\\0{0,4}(54|74)(\r\n|[ \t\r\n\f])?|\\t
V         v|\\0{0,4}(58|78)(\r\n|[ \t\r\n\f])?|\\v

Upvotes: 1

Related Questions