Path: csiph.com!weretis.net!feeder4.news.weretis.net!feeder5.news.weretis.net!news.solani.org!.POSTED!not-for-mail
From: Thomas 'PointedEars' Lahn <PointedEars@web.de>
Newsgroups: comp.lang.javascript
Subject: Re: How to deal with "messy" quotes?
Date: Mon, 12 Dec 2016 21:19:50 +0100
Organization: PointedEars Software (PES)
Lines: 83
Message-ID: <1671655.6tgchFWduM@PointedEars.de>
References: <e02b3e17-0584-4751-ac26-28897820e1c2@googlegroups.com> <zuB3A.371253$kM7.70526@fx44.am4>
Reply-To: Thomas 'PointedEars' Lahn <cljs@PointedEars.de>
Mime-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 8Bit
X-Trace: solani.org 1481573991 11241 eJwFwQkBwDAIA0BLK4RnciAU/xJ6Z+rHGXBz2NoK41Nht/h08HSpFHJEA5Ebc5EXW0T/RdYDIpUR5A== (12 Dec 2016 20:19:51 GMT)
X-Complaints-To: abuse@news.solani.org
NNTP-Posting-Date: Mon, 12 Dec 2016 20:19:51 +0000 (UTC)
User-Agent: KNode/4.14.2
Cancel-Lock: sha1:0xdW/4wWU/ZkM6UmnB53Khoi65s=
X-Face: %i>XG-yXR'\"2P/C_aO%~;2o~?g0pPKmbOw^=NT`tprDEf++D.m7"}HW6.#=U:?2GGctkL,f89@H46O$ASoW&?s}.k+&.<b';Md8`dH6iqhT)6C^.Px|[=M@7=Ik[_w<%n1Up"LPQNu2m8|L!/3iby{-]A+#YE}Kl{Cw$\U!kD%K}\2jz"QQP6Uqr],./"?;=4v
X-User-ID: eJwNyMEBwCAIA8CZRJLIOICy/wjtPQ+biy0n6BgMJbJUMHjm2j6eBwGpeHc/VARXO/869w1x1E/lE2bM+QA03RUH
X-NNTP-Posting-Host: eJwFwYEBwCAIA7CXZIVWzxGQ/09YEqCx5Ax6TAwKIng6p3E/GcbXscvVDyhbtfXOlvImU/UDEusRAw==
Face: iVBORw0KGgoAAAANSUhEUgAAADAAAAAwBAMAAAClLOS0AAAAGFBMVEXTxa4RFk5dUWANED8PFEfy7+MGBiW+n3ZNF/QuAAACaElEQVQ4jVXUwVOcMBQG8Dc7Rc4PUntdWV2uxjDpGaGeozOp1woar4jd5t/v9wLstMwsA/ntlxdCAgUc1hjTc9/JCZfGoo3wG3HdmdAWrIJRHe7GM/TmpY5VFefuVcAkkPbLIaN8rmPmjloyZxgyR3GuJ4K0AGtJ2htz8o7yqikm759fldQXaMpbDzjKAG+8v+AugVTOPO5DOjLvGtUYQwh0CPjnVMyGd+8/GfUB5nLKJDD2aLDh5HYyMDJGDwQIo2ZmZcKbowNmAdB/AzyFhrmF2MHRb0QJJfaAnwGB6orZhoykLzJtGwF/xpYxI1dswomiUj3gTuAIqCn/4C7cULwGNBtwMTk3Y4LfKB5YUaOKBKYtpplm7u0vip8tU1NWWyI/7XdcSuIDoMt6rVHMWT0DbjHPGqDqZVSa6zleLcUTcIKLoMv3ueJluALtAo9B302zPPlrtiVScRdCjXvVh3e3JpYa/jjkuC9N+LrBMlz/eAN4eQijX2EdLo6c5tGGHwLyHFtXk89dDGHwCVhG9T0S/j55AhRZgkMCmUQXJ49TnS1wnQDvw0eAh9ICeMmEFbCnPMFzjAvsWoEWEFdYEx+S0MoUZ1gT1wId8+AF3Bl2OoEu906AUHx5VLw/gXYg/x84loOah/2UYNrgiwSwGO7RfUzVBbx/kgpckumGOi6QirtD6gkLTitbnxNol47S2jVc2vsN5kPqaAHT8uUdAJM4v/DanjYOwmUjWznGfwB7sGtAtor5BgofDuzaRj4kSQAqDakTsKORa3Q3xKi3gE1fhl71KRMqrdZ2AWNNg/YOhQyrVBnb+i+nEg4bsDA+egAAAABJRU5ErkJggg==
Xref: csiph.com comp.lang.javascript:31823

cyber@example.com wrote:
^^^^^^^^^^^^^^^^^
The From header field of your postings so far is disregarding Netiquette.  
Internet is the thing with cables; Usenet is the thing with *people*.

Also, the address part of the From header field of your postings so far
is violating RFC 5536, § 3.1.2 [1] and disregarding RFC 2606, § 2 [2].  
Otherwise it would have been possible to notify you of your first mistake 
via e-mail [3].

Scorefile adjusted accordingly.

_______
[1] <https://tools.ietf.org/html/rfc5536#section-3.1.2>
[2] <https://tools.ietf.org/html/rfc2606#section-2>
[3] <http://www.interhack.net/pubs/munging-harmful/>

> var s = document.getElementById('nav'),
>   num = 0,
>   fn = " a new field name ";
> /* in my actual code, the var s represent an element dynamically created
> but to get key point across I'm using static element here
> */
> s.innerHTML = "&nbsp;" + fn +  " <input type='button' value='x' onclick =
> 'newFN(\""+fn+" + \", \"+num+\");'>";

The "field name" does not belong in the attribute value, and in a *single*-
quoted string literal *double*-quotes do _not_ need to be escaped (and vice-
versa).  Because “num” and “fn” are global, they can be used as-is.  
However, the expanded value of “fn” needs to escaped to avoid code 
injection:

  s.innerHTML = "&nbsp;"
    + fn.replace(/&/g, "&amp;").replace(/</g, "&lt;")
    + " <input type='button' value='x' onclick='newFN(fn, num);'>";

But if one insists that the expansions be in the attribute value, they must 
be escaped, too:

  String.prototype.escapeHTML = function () {
    return this
     .replace(/&/g, "&amp;")
     .replace(/</g, "&lt;")
     .replace(/"/g, "\\$&");
  };

  fn = fn.escapeHTML();
  num = num.escapeHTML();
 
This is another reason why it is a bad idea to access the “innerHTML” 
property this way.  The proper way does not require escaping:

  /* standards-compliant */
  while (s.lastChild) s.removeChild(s.lastChild);

  /* proprietary */
  s.innerHTML = "";

  /* all */
  s.appendChild(document.createTextNode("\u00a0 " + fn + " ");

  var input = document.createElement("input");

  /* ECMAScript 2016 */
  Object.assign(input, {
    type: "button",
    value: "x",
    onclick: function () { newFN(fn, num); }
  });

  /* other */
  input.type = "button";
  input.value = "x";
  input.onclick = function () { newFN(fn, num); };

  /* all */
  s.appendChild(input);

-- 
PointedEars
FAQ: <http://PointedEars.de/faq> | <http://PointedEars.de/es-matrix>
<https://github.com/PointedEars> | <http://PointedEars.de/wsvn/>
Twitter: @PointedEars2 | Please do not cc me./Bitte keine Kopien per E-Mail.