How to escape and unescape strings with jQuery and mySQL.

Question

I have a field in my database that has a freetext area, and uses quotes for many things. On my website, that field is shown in a textarea, but I can't simply put the value between the textarea tags. I need to be able to set it with javascript. I use jQuery to do this, via:

jQuery('#notes').val('{NOTES}');

Since the text can have single or double quotes, I'm unsure how to pass this from mySQL, to PHP, to jQuery so I can put it in my textarea. Has anyone done this before?

Problem solved using:

jQuery('#notes').val(jQuery('#your-hidden-div-id').html());

Answer 1

You can html encode it. php certainly has something built in, I will look it up.

It looks like

jQuery('#notes').val('<? htmlspecialchars("NOTES"); ?>');

might be what you want.

Answer 2

Are you worried about double-escaping? Simply pulling it out of the database won't change any of the characters. How do you pass it from PHP to Javascript? An AJAX request? If you receive the data as text, there shouldn't be any escaping either.

Where you need to be careful is sending it from jQuery back to MySQL via PHP.

Answer 3

Use addslashes() from PHP to escape quotes so they can be used inside JavaScript strings:

jQuery('#notes').val('<?php echo addslashes($your_string); ?>');

From your code I assume you may use some sort of template engine so you should add addslashes where you assign {NOTES}.

If you have newlines inside your data you may need to remove them too as this will break JS string (remove with a PCRE regular expression for example). Another way would be to load your data inside a hidden <div> and then:

jQuery('#notes').val(jQuery('#your-hidden-div-id').html());

Answer 4

jQuery('#notes').text('{NODES}')

should escape your string. Im not sure if it works on textearea's but i think so.

You can also try to use the following jQuery plugin:

http://plugins.jquery.com/project/escape

Some code like this should work than:

jQuery('#notes').val($.escape('{NODES}'))

UPDATE

This should work aswell

{NODES}.replace('\'','\\\'');
{NODES}.replace('\"','\\\"');