How do I escape content that might include a quotation mark?

Question

I'm wanting to capture my search terms and pass them to a JavaScript variable, but I don't know how to handle quotes that might come through.

Here's what I have currently:

var searchTerms = "<!--#echo var="terms"-->";
var pattern = / /g;
newSearchTerms = searchTerms.replace(/[^a-zA-Z 0-9]+/g,'');
var searchStr=newSearchTerms.replace(pattern,"_");

I'm concerned that should "terms" contain double quotes (or an apostrophy if I use single quotes in the JS) then my function will fail.

How do I escape the string before it gets into script?

Thanks,
Steve

---

Edit/answer: I ended up doing this by moving this to an external script that captured and parsed the querystring rather than echoing it in the HTML.

Answer 1

If terms contains quotation marks, by the time you have done var searchTerms = "<!--#echo var="terms"-->"; it is already too late to replace any quotation marks, your JavaScript will be invalid. For example, if terms contains These are the "terms" your JavaScript would appear as follows (and produce a syntax error in the browser):

var searchTerms = "These are the "terms"";

If you are sure terms only contains double-quotes, you could do:

var searchTerms = '<!--#echo var="terms"-->';

If it could contain both single-quotes and double-quotes, you need to sanitize the output on the server using a server-side technology more sophisticated than <!--#echo var="..."-->.

Answer 2

i would add a javascript to the onchange event for the search textbox. capture the keystroke and ignore the quotes and any other special characters that might be entered. if the input is coming from the server side, then sanitize it before sending it to your script.

Answer 3

From your code it looks like you're using Apache SSI includes. The echo SSI has an attribute called encoding which wil let you specify url-style encoding. You can encode quotes this way and simply unencode in Javascript with unescape()

Try this:

var terms = "<!--#echo encoding="url" var="terms"-->";
terms = unescape(terms)

Answer 4

Both the idea of encoding the output and capturing and escaping the keystrokes are interesting solutions. Encoding the SSI output isn't working for me at the moment, though I'm setting that option in motion, but escaping the keystrokes makes me nervous as I'm not sure how well our search engine will deal with it.

Thanks for the two pointers towards a possible solution.