Groups > comp.lang.javascript > #31805 > unrolled thread

How to deal with "messy" quotes?

Started by	justaguy <lichunshen84@gmail.com>
First post	2016-12-11 16:23 -0800
Last post	2016-12-12 20:50 +0100
Articles	2 on this page of 22 — 4 participants

Back to article view | Back to comp.lang.javascript

  How to deal with "messy" quotes? justaguy <lichunshen84@gmail.com> - 2016-12-11 16:23 -0800
    Re: How to deal with "messy" quotes? JJ <jj4public@vfemail.net> - 2016-12-12 12:42 +0700
      Re: How to deal with "messy" quotes? justaguy <lichunshen84@gmail.com> - 2016-12-12 09:56 -0800
        Re: How to deal with "messy" quotes? JJ <jj4public@vfemail.net> - 2016-12-13 18:18 +0700
          Re: How to deal with "messy" quotes? JJ <jj4public@vfemail.net> - 2016-12-13 18:22 +0700
            Re: How to deal with "messy" quotes? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-12-13 13:10 +0100
      Re: How to deal with "messy" quotes? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-12-12 20:43 +0100
    Re: How to deal with "messy" quotes? <cyber@example.com> - 2016-12-12 17:53 +0000
      Re: How to deal with "messy" quotes? justaguy <lichunshen84@gmail.com> - 2016-12-12 10:05 -0800
        Re: How to deal with "messy" quotes? <cyber@example.com> - 2016-12-12 18:15 +0000
          Re: How to deal with "messy" quotes? justaguy <lichunshen84@gmail.com> - 2016-12-12 14:10 -0800
            Re: How to deal with "messy" quotes? justaguy <lichunshen84@gmail.com> - 2016-12-12 16:56 -0800
              Re: How to deal with "messy" quotes? <cyber@example.com> - 2016-12-13 11:49 +0000
                Re: How to deal with "messy" quotes? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-12-13 13:17 +0100
                  Re: How to deal with "messy" quotes? <cyber@example.com> - 2016-12-13 18:32 +0000
                    Re: How to deal with "messy" quotes? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-12-13 19:47 +0100
                      Re: How to deal with "messy" quotes? <cyber@example.com> - 2016-12-13 19:43 +0000
                        Re: How to deal with "messy" quotes? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-12-14 12:24 +0100
                Re: How to deal with "messy" quotes? justaguy <lichunshen84@gmail.com> - 2016-12-13 17:07 -0800
      Re: How to deal with "messy" quotes? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-12-12 21:19 +0100
        Re: How to deal with "messy" quotes? justaguy <lichunshen84@gmail.com> - 2016-12-12 12:51 -0800
    Re: How to deal with "messy" quotes? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-12-12 20:50 +0100

Page 2 of 2 — ← Prev page 1 [2]

#31825

From	justaguy <lichunshen84@gmail.com>
Date	2016-12-12 12:51 -0800
Message-ID	<3fc3e1af-d821-46f1-9ab3-eb10f0d5d6a2@googlegroups.com>
In reply to	#31823

On Monday, December 12, 2016 at 3:20:03 PM UTC-5, Thomas 'PointedEars' Lahn wrote:
>  wrote:
> ^^^^^^^^^^^^^^^^^
> The From header field of your postings so far is disregarding Netiquette.  
> Internet is the thing with cables; Usenet is the thing with *people*.
> 
> Also, the address part of the From header field of your postings so far
> is violating RFC 5536, § 3.1.2 [1] and disregarding RFC 2606, § 2 [2].  
> Otherwise it would have been possible to notify you of your first mistake 
> via e-mail [3].
> 
> Scorefile adjusted accordingly.
> 
> _______
> [1] <https://tools.ietf.org/html/rfc5536#section-3.1.2>
> [2] <https://tools.ietf.org/html/rfc2606#section-2>
> [3] <http://www.interhack.net/pubs/munging-harmful/>
> 
> > var s = document.getElementById('nav'),
> >   num = 0,
> >   fn = " a new field name ";
> > /* in my actual code, the var s represent an element dynamically created
> > but to get key point across I'm using static element here
> > */
> > s.innerHTML = "&nbsp;" + fn +  " <input type='button' value='x' onclick =
> > 'newFN(\""+fn+" + \", \"+num+\");'>";
> 
> The "field name" does not belong in the attribute value, and in a *single*-
> quoted string literal *double*-quotes do _not_ need to be escaped (and vice-
> versa).  Because “num” and “fn” are global, they can be used as-is.  
> However, the expanded value of “fn” needs to escaped to avoid code 
> injection:
> 
>   s.innerHTML = "&nbsp;"
>     + fn.replace(/&/g, "&amp;").replace(/</g, "&lt;")
>     + " <input type='button' value='x' onclick='newFN(fn, num);'>";
> 
> But if one insists that the expansions be in the attribute value, they must 
> be escaped, too:
> 
>   String.prototype.escapeHTML = function () {
>     return this
>      .replace(/&/g, "&amp;")
>      .replace(/</g, "&lt;")
>      .replace(/"/g, "\\$&");
>   };
> 
>   fn = fn.escapeHTML();
>   num = num.escapeHTML();
>  
> This is another reason why it is a bad idea to access the “innerHTML” 
> property this way.  The proper way does not require escaping:
> 
>   /* standards-compliant */
>   while (s.lastChild) s.removeChild(s.lastChild);
> 
>   /* proprietary */
>   s.innerHTML = "";
> 
>   /* all */
>   s.appendChild(document.createTextNode("\u00a0 " + fn + " ");
> 
>   var input = document.createElement("input");
> 
>   /* ECMAScript 2016 */
>   Object.assign(input, {
>     type: "button",
>     value: "x",
>     onclick: function () { newFN(fn, num); }
>   });
> 
>   /* other */
>   input.type = "button";
>   input.value = "x";
>   input.onclick = function () { newFN(fn, num); };
> 
>   /* all */
>   s.appendChild(input);
> 


Let me try the existing coding first, the following code generated an error of var fn not defined.  Fyi, the fn content is simple text, ie, "a new field name".

	s.innerHTML = "&nbsp;" 
	+ fn +  
	" <input type='button' value='x' onclick = 'newFN(fn,num);'>";

Thanks.

[toc] | [prev] | [next] | [standalone]

#31822

From	Thomas 'PointedEars' Lahn <PointedEars@web.de>
Date	2016-12-12 20:50 +0100
Message-ID	<2474381.88bMQJbFj6@PointedEars.de>
In reply to	#31805

Stefan Ram wrote:

> ram@zedat.fu-berlin.de (Stefan Ram) writes:
>>justaguy <lichunshen84@gmail.com> writes:
>>>s.innerHTML = "&nbsp;" + fn +  " <input type='button' value='x'
>>To make it more readable, intersperse line breaks
>>s.innerHTML = "&nbsp;"
>>+ fn
>>+ " <input type='button' value='x'
> 
>   Due to automatic semicolon insertation, this might not always work.

This will always work.

>   Well. So, maybe:
> 
> s.innerHTML =
> "&nbsp;" +
> fn +
> " <input type='button' value='x'

Whatever operator code style you choose, the following lines should be 
indented:

  s.innerHTML = "&nbsp;" +
    fn +
    " <input type='button' value='x'…";

In implementations of ECMAScript 2016 one may forego the concatenation with 
a template literal:

  s.innerHTML = `&nbsp;${fn} <input type="button" value="x"…`;

Of course, accessing the “innerHTML” property is seldom justified to begin 
with.
 
>   ...
> 
>   (I first wrote it this way, but then I noticed that the
>   »+« sign was moving. So I wanted to align the »+« signs.)

That is what I do:

  s = "foo"
    + bar
    + "baz";

-- 
PointedEars
FAQ: <http://PointedEars.de/faq> | <http://PointedEars.de/es-matrix>
<https://github.com/PointedEars> | <http://PointedEars.de/wsvn/>
Twitter: @PointedEars2 | Please do not cc me./Bitte keine Kopien per E-Mail.

[toc] | [prev] | [standalone]

Page 2 of 2 — ← Prev page 1 [2]

csiph-web

How to deal with "messy" quotes?

Contents

#31825

#31822