Know of a good way to clean a string in .net to be used in Javascript?

Question

I am creating a javascript confirm message in my asp.net code:

deleteButton.Attributes.Add("onclick", "javascript:return confirm('Are you sure you want to delete client " + clientName + "')");

The problem here is that the client name can have apostrophes and other problematic characters.

Does anyone know a good, simple way to clean the variable "clientName" so that I can safely use it in the javascript?

Thanks!

Answer 1

new JavaScriptSerializer().Serialize(clientName)

Answer 2

I'm not sure how to do it in .net but rule number one with user input is not to clean, but to escape it.

Otherwhise users won't be able to have " in their usernames (might not be so common but in other situations, like this response to your question i had a very legitmate reason to include a ")

Answer 3

I'm sure you've thought of this, but the .Replace()function is about as simple as it gets.

deleteButton.Attributes.Add("onclick", "javascript:return confirm('Are you sure you want to delete client " + clientName.Replace("'", "&_#39" + "')");

Answer 4

To get a little fancier:

    public static string ToJavascriptString(this string str)
 {
  Dictionary<string, string> replace = new Dictionary<string, string>();
  replace.Add("'", @"\'");
  replace.Keys.ToList().ForEach(s => str = str.Replace(s, replace[s]));
  return str;
 }

Answer 5

SecurityElement.Escape(string s)