jQuery, comments posted with quotes aren't working, otherwise it works great.

Question

If I post a comment like "hello there dog" it works great, but if there are any special characters like ' or " the comment is posted successfully to the database but the jQuery code is not displaying the comment in the list.

Thanks for any tips.

function feedbacksubmit () {
// Show the Ajax Loader
$("#ajaxloader").css("display","inline");
var textsubmitted = $("#feedbackinput").val();

if (textsubmitted.length < 5) {
    alert("Don't forget to write something!");
    // Hide the Ajax Loader
    $("#ajaxloader").css("display","none");
}
else {
    $.post("/feedback/ajax/insert/", {feedback: textsubmitted}, 
        function(data) {
            // Place the comment in the top of the list
            $('<li></li>').prependTo("#comment-list").hide().prepend(data.commenttext2insert).fadeIn('slow');
            // Hide the Ajax Loader
            $("#ajaxloader").css("display","none");
            // Clear out the textarea
            $("#feedbackinput").val('');
    }, "json");
}
}

Here is an example response that is not working with the jQuery code above:

{"returnmessage":"The Ajax operation was successful.","returncode":"0","commenttext2insert":"\n\t<div class=\"comment-header\">\n\t\t<span class=\"comment-avatar\">\n\t\t\t<a href=\"\">\n\t\t\t\t\n\t\t\t\t\t<img src=\"/_images/users/photos//17941/nobosh.jpg\" />\t\t\t\t\t\t\t\n\t\t\t\t\n\t\t\t</a>\n\t\t</span>\n\t\t<span class=\"comment-author\">\n\t\t\t<a href=\"\">\n\t\t\t\t<b>BOB Man</b>\n\t\t\t</a>\n\t\t</span>\n\t\t<span class=\"comment-timestamp\">just now</span>\n\t</div>\n\t<div class=\"comment-body\">\n\t\t<p>12wsa\'</p>\n\t</div>\n"}

Answer 1

Try something like:

$.post("/feedback/ajax/insert/", {feedback: escape(textsubmitted)},
...

Answer 2

If you're preparing HTML in the server side, you need to make sure that all reserved HTML characters in user-controlled input are properly escaped, else it may cause the JS code to become syntactically invalid (and make your website prone for XSS). You need escape at least the reserved HTML characters <, >, &, " and ' into HTML entities <, >, &, " and ' respectively.

You mentioned that you're using Coldfusion, which is Java based. As the standard Java SE/EE API doesn't provide builtin facilities to escape them, you'll need to either write one yourself, e.g.

public static final String escapeHTML(String string){
    StringBuilder builder = new StringBuilder();
    for (char c : string.toCharArray()) {
        switch (c) {
            case '<': builder.append("&lt;"); break;
            case '>': builder.append("&gt;"); break;
            case '&': builder.append("&amp;"); break;
            case '"': builder.append("&quot;"); break;
            case '\'': builder.append("&apos;"); break;
            default: builder.append(c); break;
        }
    }
    return builder.toString();
}

..which can be used as

input = escapeHTML(input);

..or to grab for example Apache Commons Lang StringEscapeUtils#escapeHtml4 which can be used as

input = StringEscapeUtils.escapeHtml4(input);

Once again, only do this for user-controlled input. You don't need to do this for any HTML code which you hardcoded in the server side code (else it would get displayed plain as-is). Thus do something like:

StringBuilder comment = new StringBuilder();
comment.append("<div class=\"comment\">");
comment.append(escapeHTML(input));
comment.append("</div>");

That said, I already commented in your question with the hint that you'd better to do this in jQuery, because that's after all much better for maintainability and reusability. You don't want to have raw HTML somewhere hidden in depths of Java code. You also don't want to make the JSON result dependent of the purpose. Just return a generic (and HTML-sanitized) JSON result and let jQuery build the HTML.

Answer 3

What does your ColdFusion look like (at least the part where you return something to the browser)? If BalusC is right about needing to escape html characters in your return data, you can just wrap your text with the HTMLEditFormat function rather than needing to write anything in Java.