Javascript/<text area >

Question

alert("...");

var values = "value1
valu2part1 value2part2 
value3
valu4";
alert(values);

I assigning

var values = "<%=Model.Values%>";

this values are stred in a databse .this values are entered through a textarea and in database each line is seperated by \t\r

when i take this toa javacript varable using

var values = "<%=Model.Values%>";

I am getting some thing like

var values = "value1
valu2part1 value2part2
value3
valu4";

But this is error what can i do

Answer 1

You can replace your new lines with escape sequences (\n) before outputting your string to the JS.

Answer 2

var values = "<%=Model.Values%>";

This is unsafe. Not only will it fail when there are newlines in the string (as JavaScript string literals cannot span multiple lines), it's also possible for a " in the value to end the string prematurely. If the value contains user-submitted data, that's a script-injection security hole (XSS).

To create JS literal syntax use a JSON serialiser. For example with JavaScriptSerializer:

var values= <%= new JavaScriptSerializer().Serialize(Model.Values) %>;

or eg Json.NET if you're on older .NET versions.