Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.javascript > #21694 > unrolled thread

What to do with double quote etc

Back to article view | Back to comp.lang.javascript

Contents

  What to do with double quote etc Andrew Poulos <ap_prog@hotmail.com> - 2013-10-23 08:24 +1100
    Re: What to do with double quote etc Christoph Michael Becker <cmbecker69@arcor.de> - 2013-10-23 01:03 +0200
      Re: What to do with double quote etc Andrew Poulos <ap_prog@hotmail.com> - 2013-10-23 10:17 +1100
        Re: What to do with double quote etc Christoph Michael Becker <cmbecker69@arcor.de> - 2013-10-23 02:20 +0200
          Re: What to do with double quote etc Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2013-10-24 12:33 +0200
    Re: What to do with double quote etc "Michael Haufe (TNO)" <tno@thenewobjective.com> - 2013-10-22 20:41 -0700
    Re: What to do with double quote etc Bart Van der Donck <bart@nijlen.com> - 2013-10-23 07:51 -0700

#21694 — What to do with double quote etc

I've a page with a text area. If a user enters, say,
   Start quote "
its encoded to
   Start%20quote%20%22
before its written to the database. If a user enters, say
   Line 1
   Line 2
its encoded to
   Line%201%0ALine%202

Fine so far.

The problem is later when the decoded database values are written into a 
js variable. For example,
   myvar = "<%= decoded value %>";
will give
   myvar = "Start quote "";
or
   myvar = "Line 1
Line 2";

Both of which are invalid.

What is a typical approach to deal with this?

Andrew Poulos

[toc] | [next] | [standalone]

#21696

Andrew Poulos wrote:

> I've a page with a text area. If a user enters, say,
>   Start quote "
> its encoded to
>   Start%20quote%20%22
> before its written to the database. If a user enters, say
>   Line 1
>   Line 2
> its encoded to
>   Line%201%0ALine%202
> 
> Fine so far.

I somewhat doubt that you will want to (and actually do) have URL
encoded values in your database.

> The problem is later when the decoded database values are written into a
> js variable. For example,
>   myvar = "<%= decoded value %>";
> will give
>   myvar = "Start quote "";
> or
>   myvar = "Line 1
> Line 2";
> 
> Both of which are invalid.
> 
> What is a typical approach to deal with this?

The typical approach is to properly escape (aka. quote) the value, e.g.
the second string should be written as "Line 1\u000ALine2".  I can't say
how to do this in your server side language/framework (you may want to
clarify if it is JScript/ASP), as I don't do server side programming in
an ECMAScript implementation.

-- 
Christoph M. Becker

[toc] | [prev] | [next] | [standalone]

#21697

On 23/10/2013 10:03 AM, Christoph Michael Becker wrote:
> Andrew Poulos wrote:
>
>> I've a page with a text area. If a user enters, say,
>>    Start quote "
>> its encoded to
>>    Start%20quote%20%22
>> before its written to the database. If a user enters, say
>>    Line 1
>>    Line 2
>> its encoded to
>>    Line%201%0ALine%202
>>
>> Fine so far.
>
> I somewhat doubt that you will want to (and actually do) have URL
> encoded values in your database.

The database does ahve URL encoded values. Why isn't that a good idea?

>> The problem is later when the decoded database values are written into a
>> js variable. For example,
>>    myvar = "<%= decoded value %>";
>> will give
>>    myvar = "Start quote "";
>> or
>>    myvar = "Line 1
>> Line 2";
>>
>> Both of which are invalid.
>>
>> What is a typical approach to deal with this?
>
> The typical approach is to properly escape (aka. quote) the value, e.g.
> the second string should be written as "Line 1\u000ALine2".  I can't say

Are you saying that I should find things that could be a problem and 
then replace them accordingly, rather than URL encoding the string?

> how to do this in your server side language/framework (you may want to
> clarify if it is JScript/ASP), as I don't do server side programming in
> an ECMAScript implementation.

I am working in JScript/ASP.

Andrew Poulos

[toc] | [prev] | [next] | [standalone]

#21698

Andrew Poulos wrote:

> On 23/10/2013 10:03 AM, Christoph Michael Becker wrote:
>> Andrew Poulos wrote:
>>
>>> I've a page with a text area. If a user enters, say,
>>>    Start quote "
>>> its encoded to
>>>    Start%20quote%20%22
>>> before its written to the database. If a user enters, say
>>>    Line 1
>>>    Line 2
>>> its encoded to
>>>    Line%201%0ALine%202
>>>
>>> Fine so far.
>>
>> I somewhat doubt that you will want to (and actually do) have URL
>> encoded values in your database.
> 
> The database does ahve URL encoded values. Why isn't that a good idea?

I would prefer to keep the model free from any representation issues.
That makes it easier to use the data for different purposes.  For
instance, the character "<" can be used verbatim in a text/plain encoded
email, but has to be escaped as "&lt;" in a text/html encoded email.  In
an URI, however, it has to be quoted as "%3C".

>>> The problem is later when the decoded database values are written into a
>>> js variable. For example,
>>>    myvar = "<%= decoded value %>";
>>> will give
>>>    myvar = "Start quote "";
>>> or
>>>    myvar = "Line 1
>>> Line 2";
>>>
>>> Both of which are invalid.
>>>
>>> What is a typical approach to deal with this?
>>
>> The typical approach is to properly escape (aka. quote) the value, e.g.
>> the second string should be written as "Line 1\u000ALine2".  I can't say
> 
> Are you saying that I should find things that could be a problem and
> then replace them accordingly, rather than URL encoding the string?

A URL encoded string doesn't make much sense in a browser, generally.
URL encoding (aka. percent encoding) is primarily useful to build
URLs/URIs.  Just try:

   console.log("Line%201");

The result is most likely not what is desired.  If you had stored the
string as "Line 1", you could have used it client side unmodified.  Only
"some" characters would need quoting in this case.  Replacing them
manually is ugly, indeed, but the server side language/framework may
already have a simple solution to do the necessary quoting.  JSON
encoding comes to mind, but according to RFC 4627 a simple string is not
a valid JSON-text.  However, this restriction must not hold for the
given implementation.

[In PHP 5.2+ you could properly quote strings stored in URL encoded form
for client side ECMAScript:

    json_encode(urldecode('line%201'));

]

>> how to do this in your server side language/framework (you may want to
>> clarify if it is JScript/ASP), as I don't do server side programming in
>> an ECMAScript implementation.
> 
> I am working in JScript/ASP.

-- 
Christoph M. Becker

[toc] | [prev] | [next] | [standalone]

#21715

Christoph Michael Becker wrote:

> Andrew Poulos wrote:
>> The database does ahve URL encoded values. Why isn't that a good idea?
> 
> I would prefer to keep the model free from any representation issues.

ACK.

> JSON encoding comes to mind, but according to RFC 4627 a simple string is
> not a valid JSON-text.

Still, server-side and client-side implementations can handle it.

-- 
PointedEars

Twitter: @PointedEars2
Please do not Cc: me. / Bitte keine Kopien per E-Mail.

[toc] | [prev] | [next] | [standalone]

#21699

On Tuesday, October 22, 2013 4:24:40 PM UTC-5, Andrew Poulos wrote:
> I've a page with a text area. If a user enters, say,
>    Start quote "
> its encoded to
>    Start%20quote%20%22
> before its written to the database. If a user enters, say
>    Line 1
>    Line 2
> its encoded to
>    Line%201%0ALine%202
>
> Fine so far.
>
> The problem is later when the decoded database values are written into a 
> 
> js variable. For example,
>    myvar = "<%= decoded value %>";
> will give
>    myvar = "Start quote "";
> or
>    myvar = "Line 1
> Line 2";
> 
> Both of which are invalid.
> 
> What is a typical approach to deal with this?


I've never been a fan of having server code pollute my client code. What I've done is dump the data into a <script type="something-custom"> element on the page and then use the dom to access that section. You could also dump into hidden form fields to then later retrieve the data. Alternative, I've also used a separate server request AJAX to get the data instead.

[toc] | [prev] | [next] | [standalone]

#21703

Andrew Poulos wrote:

> I've a page with a text area. If a user enters, say,
>    Start quote "
> its encoded to
>    Start%20quote%20%22
> before its written to the database. If a user enters, say
>    Line 1
>    Line 2
> its encoded to
>    Line%201%0ALine%202
> 
> Fine so far.
> 
> The problem is later when the decoded database values are 
> written into a js variable. For example,
> 
>    myvar = "<%= decoded value %>";
> will give
>    myvar = "Start quote "";
> or
>    myvar = "Line 1
> Line 2";
> Both of which are invalid.
> What is a typical approach to deal with this?

In my 15 years of coding I've often seen such issues. I simply reject such characters from the beginning. In your case, I would replace ["] by [´´].

-- 
 Bart

[toc] | [prev] | [standalone]

Back to top | Article view | comp.lang.javascript

csiph-web