Help needed in using escape function in javascript

Question

Hi All:
I am using the follwing javascript function in my jsp file

 <script language="javascript">

                    function openPopup()
                    {
                        var firstname = escape(<%=addressBean.getFirstName()%>);
                        var lastname = escape(<%=addressBean.getLastName()%>);
                        alert(firstname);
                        alert(lastname);
                        var mywindow = window.open('<%= link("*", "BBFBUpdatePickupInfo")%>&ShoppingCartKey=<%=cartKey%>&operation=<%=operation%>&isEproAcc=<%=isEpro%>&firstName="+firstname+"&lastName="+lastname+"&areaCode=<%=addressBean.getPhoneAreaCode()%>&phoneNum=<%=addressBean.getPhoneNumber()%>','static','width=625,height=500,toolbar=0,location=0,directories=0,status=0,menuBar=0,scrollBars=yes,resizable=0');
                        mywindow.focus();
                    }


                </script>

When addressBean.getFirstName() and addressBean.getLastName() returns names like "RED" as firstname and "WHITE" as lastname it is working fine. But when these two methods returns name like "VALENTINE" as firstname and "D'LOREY" as second name it is throwing below javascript error

  Error: Unterminated string constant
  Code: 0

Please help me to come out of this problem. Thanks in advance

Answer 1

(You haven't mentioned what your server-side language is; below I've assumed Java, so make adjustments if it's something else.)

Think about what's actually getting sent to the browser when you do this:

var firstname = escape(<%=addressBean.getFirstName()%>);

When it goes out, it'll look like this:

var firstname = escape(JOE);

...which is almost certainly not what you want -- there are no quotes, for a start.

So first we need quotes:

var firstname = escape("<%=addressBean.getFirstName()%>");

But we also need to escape anything in the string that's going to be an issue in the resulting JavaScript string (on the server, when sending it to the browser). Off the cuff, that'll be at least quotes and backslashes, so:

var firstname = escape("<%=addressBean.getFirstName().replace("\\", "\\\\").replace("\"", "\\\"")%>");

...but that's not thorough at all, you'll need to handle lots of other cases (newlines in the string, etc.). Really, you're going to want a utility function that does the work thoroughly, handling (for instance) unicode sequences, etc., if there's any possibility they'll be in the source data (which there very much is, if this involves people's names).

And many have noted that instead of escape, you want encodeURIComponent.

Answer 2

You need to properly format your string so that it is compatible with JavaScript syntax in variables definition.

This is what I do with PHP through the json_encode() function:

var firstname = <?=json_encode(addressBean.getFirstName())?>;

The JSON parser takes care of escaping the appropriate values and makes it JavaScript compatible.

I'm not familiar with your language, but if it's ASP you can try out aspjson.

Answer 3

HTML and Javascript are 2 escapes. I had this problem and nonscientifically just observed switch (too fast) from georss to KML just solved

Answer 4

Just create the url server-side since it is made of server-side variables. No need to do it with strings and escapes in javascript when you have everything at hand server-side.