replacing characters with escape in a javascript string

Question

i know there must be thousands of threads like this, but the internet and stack overflow is flooded with results from other programming languages and simply replacing the characters with a whitespace and so on...

so... my problem is as follows...

i have a form with: <input type='text' id='my_input'>

then i parse all my fields in javascript (with jquery) to create my ajax call, like this

var my_value = $('#my_input').val();

then i do a replace to get the line breaks my_value = my_value.replace('\n', ' ');

after that i post my variables with ajax like this:

data_to_post = 'my_field1=' + my_value1 + 'my_field2' + my_value2;

$.ajax({  
type: 'POST',  
url: '/write_to_db.php',  
data: data_to_post
});

now many people on my site talk about programming and that content started screwing up my site, because their post content gets parsed as php or as html formatting - i'm planning to replace all the problematic characters that could screw up the code of my site.

the most problematic expressions are html tags and &= because it interferes with the way i put my post variable together.

now, because those characters are necessary for the content, i can't simply replace them all with with a single character.

is there any way i could escape them (at best in a one line command)?

thanks!

UPDATE: my temporary solution is this:

this_string = this_string.replace(/</g, '&#60;');
this_string = this_string.replace(/>/g, '&#62;');
this_string = this_string.replace(/\n/g, '<br>');
this_string = escape(this_string);

Wampie Driessen · Accepted Answer · 2012-05-18 06:51:16Z

1

try the javascript function escape(): http://www.w3schools.com/jsref/jsref_escape.asp

data_to_post = 'my_field1=' + escape(my_value1) + 'my_field2' + escape(my_value2);

Edit:

to deal with the HTML characters the people are not allowed to post, you could php this:

$outputstring = "hi<br />bye!";
echo htmlspecialchars($outputstring);

info on how this works: http://php.net/manual/en/function.htmlspecialchars.php

edited May 18, 2012 at 6:51

answered May 17, 2012 at 23:51

Wampie Driessen

1,7081 gold badge13 silver badges19 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Ben Greene Over a year ago

this works pretty good :) now i still have the html tags do deal with, do you know any solution for that?

c.hill · Accepted Answer · 2012-05-17 23:23:40Z

1

I would use $.serializeJSON() on the form element itself to gather up all the values for the entire form. Then I would send that to the server-side script via an AJAX call. A task like parsing a complex comment or text field that allows for code as well as plain text is better left to a server-side language.

answered May 17, 2012 at 23:23

c.hill

3,23327 silver badges31 bronze badges

4 Comments

Ben Greene Over a year ago

i have never used that, does this mean, i'd have to send all my my_value variables to a script that then returns them with the characters escaped?

c.hill Over a year ago

Well, this is a CMS of sorts, yes? So, you are looking to store this information in a database somewhere to be retrieved by other users? You're going to have to send it to the server at some point anyways.

Ben Greene Over a year ago

yes, it's a facebook-like community for my company. i will read about $.serializeJSON, thanks so far

c.hill Over a year ago

Someone else here suggested requiring your users to wrap the code (HTML or otherwise) in a special tag (<code> might work). This has generally been the approach I've used to achieve what you are going for. You can then read through the submitted text on the server-side and parse differently the text within the code tags from the normal plain text outside.

diafol · Accepted Answer · 2012-05-17 23:20:29Z

0

How about:

my_value = my_value.replace(/\n|\.|\~/g, '<br>');

Put your characters to replace around the | (OR) separator and have the /g flag at the end

answered May 17, 2012 at 23:20

diafol

111 silver badge1 bronze badge

2 Comments

Ben Greene Over a year ago

that's doesn't really solve my problem, because now: my_value = "my ".phpinfo()." content" returns "my " phpinfo() "content"

diafol Over a year ago

I thought that's what you wanted. I should have read your requirements more closely.

Community · Accepted Answer · 2017-05-23 11:56:29Z

0

Although your intent is not entirely clear to me, you could preserve the programmers' content and still display the carriage return/linefeed by wrapping the expression in a tag.

Another possibility is to use CSS to style the appearance. Take a look at the answer to this post: How can I replace certain carriage return line feed followed by a dash with a ?

edited May 23, 2017 at 11:56

CommunityBot

11 silver badge

answered May 17, 2012 at 23:24

earth_tom

8311 gold badge5 silver badges13 bronze badges

1 Comment

Ben Greene Over a year ago

this doesn't help me, the problem is for example when people start typing things like &=, because i post the content to php with ajax like in this variable: data_to_post = 'my_value1=' + my_value1 + '&my_value2=' + my_value2;

BrianM · Accepted Answer · 2012-05-17 23:30:43Z

0

It sounds like you are simply wanting to encode the HTML characters to preserve the HTML characters, so if this is the case the following will encode the text correctly:

var textVal = $('#my_input').val();
var encoded = $('<div/>').text(textVal).html();

This creates an in-memory div to help with encoding. To decode you can simply change the div call to:

  var unencoded = $('<div/>').html(textVal).text()

answered May 17, 2012 at 23:30

BrianM

711 silver badge7 bronze badges

3 Comments

Ben Greene Over a year ago

this is not what i'm trying to do. i'm writing the contents to a database that i then read in php with mysql_fetch_array()

BrianM Over a year ago

Then I am not totally clear based on your original question what you are trying to do. Are you simply looking for the line breaks? If not, what sets of text are you considering problematic?

Ben Greene Over a year ago

i'm looking to escape all special characters and replace line breaks with

inhan · Accepted Answer · 2012-05-17 23:53:11Z

0

Have you considered making PHP handle that for you like in the following example..?

nl2br(htmlspecialchars($str,ENT_QUOTES,'UTF-8'));

answered May 17, 2012 at 23:53

inhan

7,5002 gold badges26 silver badges35 bronze badges

Comments

Fagner Brack · Accepted Answer · 2012-05-18 03:24:00Z

0

$.ajax({  
type: 'POST',  
url: '/write_to_db.php',  
data: {
   'my_field1': my_value1,
   'my_field2': my_value2
}
});

Pass an object in the data instead of a string, jquery do that for you.

answered May 18, 2012 at 3:24

Fagner Brack

2,4234 gold badges38 silver badges70 bronze badges

Collectives™ on Stack Overflow

replacing characters with escape in a javascript string

7 Answers 7

1 Comment

4 Comments

2 Comments

1 Comment

3 Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

7 Answers 7

1 Comment

4 Comments

2 Comments

1 Comment

3 Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related