Groups | Search | Server Info | Keyboard shortcuts | Login | Register

Groups > comp.lang.java.programmer > #4874

Re: Java code to output escaped Javascript?

Show all headers | View raw

On 06/01/2011 06:17 PM, Lawrence D'Oliveiro wrote:
> In message<is5jk2$l36$1@dont-email.me>, Joshua Cranmer wrote:
>
>> On 06/01/2011 09:11 AM, laredotornado wrote:
>>
>>> private String escapeForJS(String value) {
>>> value = value.replace("\n", "\\n");
>>> value = value.replace("\r", "\\r");
>>> value = value.replace("\"", "\\\"");
>>> return value;
>>> }
>>
>> You also forgot `\' as well as every character in the range
>> '\u0000'-'\u001f' and '\u007f-\uffff' ...
>
> Can’t they just occur literally?

According to the ECMAScript specification, Line terminators (i.e., 
\u000A, \u000D, \u2028, and \u2029), `\', and the string character (", 
in this case) are prohibited from appearing in strings outright. In 
practice, anything that isn't pure ASCII puts you on shaky grounds due 
to the potential for charset confusion (the specification assumes that 
the input source text is already normalized to Unicode canonical form, 
so how engines see what you input may be different). I would also hold 
the use of, in particular, NUL and form-feed characters as potentially 
problematic. In short:

The following characters are always safe *not* to escape:
* A-Z, a-z, 0-9
* ~!@#$%^&*()_+`-={}[]|\:;<>?,./
* spaces

The following should be okay:
* ' or ", depending on how you open the string
* "simple" accented characters (i.e., \xa0-ff in your favorite 8-bit 
charset, mostly UTF-8 or Cp1252)

Never valid:
* \, \n, \r, \u2028, and \u2029

Anything else (particularly "\u0000") is potentially risky.

-- 
Beware of bugs in the above code; I have only proved it correct, not 
tried it. -- Donald E. Knuth

Back to comp.lang.java.programmer | Previous | Next — Previous in thread | Find similar

Thread

Java code to output escaped Javascript? laredotornado <laredotornado@zipmail.com> - 2011-06-01 06:11 -0700
  Re: Java code to output escaped Javascript? Travers Naran <tnaran@gmail.com> - 2011-06-01 07:47 -0700
  Re: Java code to output escaped Javascript? Joshua Cranmer <Pidgeot18@verizon.invalid> - 2011-06-01 10:50 -0400
    Re: Java code to output escaped Javascript? "laredotornado@zipmail.com" <laredotornado@gmail.com> - 2011-06-01 09:58 -0700
    Re: Java code to output escaped Javascript? Lawrence D'Oliveiro <ldo@geek-central.gen.new_zealand> - 2011-06-02 10:17 +1200
      Re: Java code to output escaped Javascript? Joshua Cranmer <Pidgeot18@verizon.invalid> - 2011-06-01 21:47 -0400

csiph-web