Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!eu.feeder.erje.net!newsfeed.datemas.de!weretis.net!feeder1.news.weretis.net!news.solani.org!.POSTED!not-for-mail
From: Thomas 'PointedEars' Lahn <PointedEars@web.de>
Newsgroups: comp.lang.javascript
Subject: Re: apostrophes
Date: Thu, 01 May 2014 10:28:19 +0200
Organization: PointedEars Software (PES)
Lines: 47
Message-ID: <5812622.OnxiGCZgKY@PointedEars.de>
References: <NPadnftYatpNe_zOnZ2dnUVZ_oqdnZ2d@westnet.com.au>
Reply-To: Thomas 'PointedEars' Lahn <cljs@PointedEars.de>
Mime-Version: 1.0
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: 7Bit
X-Trace: solani.org 1398932903 30279 eJwFwYEBwCAIA7CXQGmVcybQ/09Ygk1nnSAYEGTCa1ca25ECQl+lc593C8v2at6avklhhj8aGBEa (1 May 2014 08:28:23 GMT)
X-Complaints-To: abuse@news.solani.org
NNTP-Posting-Date: Thu, 1 May 2014 08:28:23 +0000 (UTC)
User-Agent: KNode/4.11.5
X-User-ID: eJwFwYEBwCAIA7CXQAqOc6Ta/09YklFe3KgspFJ7koecm2dFMGaHsWnvGlyEm7+i7vc82mupgUYsoXog/m0oFbU=
Face: iVBORw0KGgoAAAANSUhEUgAAADAAAAAwBAMAAAClLOS0AAAAGFBMVEXTxa4RFk5dUWANED8PFEfy7+MGBiW+n3ZNF/QuAAACaElEQVQ4jVXUwVOcMBQG8Dc7Rc4PUntdWV2uxjDpGaGeozOp1woar4jd5t/v9wLstMwsA/ntlxdCAgUc1hjTc9/JCZfGoo3wG3HdmdAWrIJRHe7GM/TmpY5VFefuVcAkkPbLIaN8rmPmjloyZxgyR3GuJ4K0AGtJ2htz8o7yqikm759fldQXaMpbDzjKAG+8v+AugVTOPO5DOjLvGtUYQwh0CPjnVMyGd+8/GfUB5nLKJDD2aLDh5HYyMDJGDwQIo2ZmZcKbowNmAdB/AzyFhrmF2MHRb0QJJfaAnwGB6orZhoykLzJtGwF/xpYxI1dswomiUj3gTuAIqCn/4C7cULwGNBtwMTk3Y4LfKB5YUaOKBKYtpplm7u0vip8tU1NWWyI/7XdcSuIDoMt6rVHMWT0DbjHPGqDqZVSa6zleLcUTcIKLoMv3ueJluALtAo9B302zPPlrtiVScRdCjXvVh3e3JpYa/jjkuC9N+LrBMlz/eAN4eQijX2EdLo6c5tGGHwLyHFtXk89dDGHwCVhG9T0S/j55AhRZgkMCmUQXJ49TnS1wnQDvw0eAh9ICeMmEFbCnPMFzjAvsWoEWEFdYEx+S0MoUZ1gT1wId8+AF3Bl2OoEu906AUHx5VLw/gXYg/x84loOah/2UYNrgiwSwGO7RfUzVBbx/kgpckumGOi6QirtD6gkLTitbnxNol47S2jVc2vsN5kPqaAHT8uUdAJM4v/DanjYOwmUjWznGfwB7sGtAtor5BgofDuzaRj4kSQAqDakTsKORa3Q3xKi3gE1fhl71KRMqrdZ2AWNNg/YOhQyrVBnb+i+nEg4bsDA+egAAAABJRU5ErkJggg==
X-Face: %i>XG-yXR'\"2P/C_aO%~;2o~?g0pPKmbOw^=NT`tprDEf++D.m7"}HW6.#=U:?2GGctkL,f89@H46O$ASoW&?s}.k+&.<b';Md8`dH6iqhT)6C^.Px|[=M@7=Ik[_w<%n1Up"LPQNu2m8|L!/3iby{-]A+#YE}Kl{Cw$\U!kD%K}\2jz"QQP6Uqr],./"?;=4v
Cancel-Lock: sha1:si7ijoL5IyVo/399AsFHvc0imqg=
X-NNTP-Posting-Host: eJwFwYkBgDAIA8CVDATajKM8+4/gXXgi6zAjGRuL0TsXpiocqMmxXliBbMrXF6UH81FjN38ZrhDW
Xref: csiph.com comp.lang.javascript:24008

Andrew Poulos wrote:

> I have a form into which users enter their names. The names get saved to
> a db. (Any apostrophes get encoded before being written to the db.)
> 
> The server side language is JScript in classic ASP.
> 
> When names get read back I use something like
> 
> Response.write("var name = '" + recSet("name").value + "';");
> 
> Which works fine until a name includes an apostrophe and the page will
> throw an error.
> 
> One way I've considered is backslashing a double quote eg
> 
> Response.write("var name = \"" + recSet("name").value + "\";");
> 
> which will only work until someone enters a name like
> Stan "The Man" Longinidis
> 
> What's a better way of handling single/double apostrophes?

Sanitize input, escape output.

Assuming that the string value does not contain newline:

  Response.write(
      "var name = '"
    + recSet("name").value.replace(/[\\']/g, "\\\\$&")
    + "';");

or if it contains newline, (the equivalent of)

  Response.write(
      "var name = "
    + JSON.stringify(recSet("name").value)
    + ";");

Consider using a string builder instead of consecutive Response.write() 
calls.

-- 
PointedEars
FAQ: <http://PointedEars.de/faq> | SVN: <http://PointedEars.de/wsvn/>
Twitter: @PointedEars2 | ES Matrix: <http://PointedEars.de/es-matrix>
Please do not Cc: me. / Bitte keine Kopien per E-Mail.