Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.javascript > #31823

Re: How to deal with "messy" quotes?

Show key headers only | View raw

cyber@example.com wrote:
^^^^^^^^^^^^^^^^^
The From header field of your postings so far is disregarding Netiquette.  
Internet is the thing with cables; Usenet is the thing with *people*.

Also, the address part of the From header field of your postings so far
is violating RFC 5536, § 3.1.2 [1] and disregarding RFC 2606, § 2 [2].  
Otherwise it would have been possible to notify you of your first mistake 
via e-mail [3].

Scorefile adjusted accordingly.

_______
[1] <https://tools.ietf.org/html/rfc5536#section-3.1.2>
[2] <https://tools.ietf.org/html/rfc2606#section-2>
[3] <http://www.interhack.net/pubs/munging-harmful/>

> var s = document.getElementById('nav'),
>   num = 0,
>   fn = " a new field name ";
> /* in my actual code, the var s represent an element dynamically created
> but to get key point across I'm using static element here
> */
> s.innerHTML = "&nbsp;" + fn +  " <input type='button' value='x' onclick =
> 'newFN(\""+fn+" + \", \"+num+\");'>";

The "field name" does not belong in the attribute value, and in a *single*-
quoted string literal *double*-quotes do _not_ need to be escaped (and vice-
versa).  Because “num” and “fn” are global, they can be used as-is.  
However, the expanded value of “fn” needs to escaped to avoid code 
injection:

  s.innerHTML = "&nbsp;"
    + fn.replace(/&/g, "&amp;").replace(/</g, "&lt;")
    + " <input type='button' value='x' onclick='newFN(fn, num);'>";

But if one insists that the expansions be in the attribute value, they must 
be escaped, too:

  String.prototype.escapeHTML = function () {
    return this
     .replace(/&/g, "&amp;")
     .replace(/</g, "&lt;")
     .replace(/"/g, "\\$&");
  };

  fn = fn.escapeHTML();
  num = num.escapeHTML();
 
This is another reason why it is a bad idea to access the “innerHTML” 
property this way.  The proper way does not require escaping:

  /* standards-compliant */
  while (s.lastChild) s.removeChild(s.lastChild);

  /* proprietary */
  s.innerHTML = "";

  /* all */
  s.appendChild(document.createTextNode("\u00a0 " + fn + " ");

  var input = document.createElement("input");

  /* ECMAScript 2016 */
  Object.assign(input, {
    type: "button",
    value: "x",
    onclick: function () { newFN(fn, num); }
  });

  /* other */
  input.type = "button";
  input.value = "x";
  input.onclick = function () { newFN(fn, num); };

  /* all */
  s.appendChild(input);

-- 
PointedEars
FAQ: <http://PointedEars.de/faq> | <http://PointedEars.de/es-matrix>
<https://github.com/PointedEars> | <http://PointedEars.de/wsvn/>
Twitter: @PointedEars2 | Please do not cc me./Bitte keine Kopien per E-Mail.

Back to comp.lang.javascript | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

How to deal with "messy" quotes? justaguy <lichunshen84@gmail.com> - 2016-12-11 16:23 -0800
  Re: How to deal with "messy" quotes? JJ <jj4public@vfemail.net> - 2016-12-12 12:42 +0700
    Re: How to deal with "messy" quotes? justaguy <lichunshen84@gmail.com> - 2016-12-12 09:56 -0800
      Re: How to deal with "messy" quotes? JJ <jj4public@vfemail.net> - 2016-12-13 18:18 +0700
        Re: How to deal with "messy" quotes? JJ <jj4public@vfemail.net> - 2016-12-13 18:22 +0700
          Re: How to deal with "messy" quotes? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-12-13 13:10 +0100
    Re: How to deal with "messy" quotes? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-12-12 20:43 +0100
  Re: How to deal with "messy" quotes? <cyber@example.com> - 2016-12-12 17:53 +0000
    Re: How to deal with "messy" quotes? justaguy <lichunshen84@gmail.com> - 2016-12-12 10:05 -0800
      Re: How to deal with "messy" quotes? <cyber@example.com> - 2016-12-12 18:15 +0000
        Re: How to deal with "messy" quotes? justaguy <lichunshen84@gmail.com> - 2016-12-12 14:10 -0800
          Re: How to deal with "messy" quotes? justaguy <lichunshen84@gmail.com> - 2016-12-12 16:56 -0800
            Re: How to deal with "messy" quotes? <cyber@example.com> - 2016-12-13 11:49 +0000
              Re: How to deal with "messy" quotes? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-12-13 13:17 +0100
                Re: How to deal with "messy" quotes? <cyber@example.com> - 2016-12-13 18:32 +0000
                Re: How to deal with "messy" quotes? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-12-13 19:47 +0100
                Re: How to deal with "messy" quotes? <cyber@example.com> - 2016-12-13 19:43 +0000
                Re: How to deal with "messy" quotes? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-12-14 12:24 +0100
              Re: How to deal with "messy" quotes? justaguy <lichunshen84@gmail.com> - 2016-12-13 17:07 -0800
    Re: How to deal with "messy" quotes? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-12-12 21:19 +0100
      Re: How to deal with "messy" quotes? justaguy <lichunshen84@gmail.com> - 2016-12-12 12:51 -0800
  Re: How to deal with "messy" quotes? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-12-12 20:50 +0100

csiph-web