Jquery embedded quote in attribute

Question

I have a custom attribute that is being filled from a database. This attribute can contain an embedded single quote like this,

  MYATT='Tony\'s Test'

At some pont in my code I use jquery to copy this attribute to a field like this,

 $('#MY_DESC').val($(recdata).attr('MYATT'));

MY_DESC is a text field in a dialog box. When I display the dialog box all I see in the field is

Tony\

What I need to see is,

Tony's Test

How can I fix this so I can see the entire string?

Answer 1

Before setting the value of your text field, you might try running a regular expression against the string to remove all backslashes from the string.

Answer 2

Try:

MYATT='Tony&#x27s Test'

I didn't bother verifying this with the HTML spec, but the wikipedia entry says:

The ability to "escape" characters in this way allows for the characters < and & (when written as &lt; and &amp;, respectively) to be interpreted as character data, rather than markup. For example, a literal < normally indicates the start of a tag, and & normally indicates the start of a character entity reference or numeric character reference; writing it as &amp; or &#x26; or &#38; allows & to be included in the content of elements or the values of attributes. The double-quote character ("), when used to quote an attribute value, must also be escaped as &quot; or &#x22; or &#34; when it appears within the attribute value itself. The single-quote character ('), when used to quote an attribute value, must also be escaped as &#x27; or &#39; (should NOT be escaped as &apos; except in XHTML documents) when it appears within the attribute value itself. However, since document authors often overlook the need to escape these characters, browsers tend to be very forgiving, treating them as markup only when subsequent text appears to confirm that intent.

Answer 3

In case you won't use double-quotes, put your custom attribute into them :) If not, I suggest escape the value.

Answer 4

If you do this:

alert($(recdata).attr('MYATT'));

You will see the same result of "Tony\" meaning that the value isn't being properly consumed by the browser. The escaped \' value isn't working in this case.

Do you have the means to edit these values as they are being produced? Can you parse them to include escape values before being rendered?