Escaping quotes from Rails Variables when using them for Javascript?

Question

I am having problems when trying to use a rails variable within javascript code.

For example, I might define a link_to_remote, with parameter :complete => "alert('my_var');"

If my_var = "I'm testing.", then the javascript code will break due to the single quote closing the code prematurely. If I try using escape_javascript(my_var) so that the quote gets turned into \', it doesn't seem to fix the problem.

I've noticed that when you try alert('I\'m testing'); there's a problem, but if you do alert('I\\'m testing'), it works. Since escape_javascript only turns ' into \', rather than \\', does somebody have a suggestion for how to handle this?

Thanks! Eric

Tom Davies · Accepted Answer · 2012-06-19 18:31:33Z

30

when you try alert('I\'m testing'); there's a problem

Backslash is also an escape in Ruby strings! So the string literal:

"alert('I\'m testing');"

means the string:

alert('I'm testing');

the backslash is gone already before JavaScript gets a look at it. When you are writing a JavaScript string literal inside a Ruby string literal you need to escape the escape, \\, to get a real \ that will then, in JavaScript, escape the apostrophe.

escape_javascript correctly generates the backslash for JavaScript, if a backslash was included in its input. But again, if you're writing a string literal, you have to escape the backslash to get a real backslash:

escape_javascript("\b")     -> this is a backspace character!
escape_javascript("\\b")    -> this is backslash-then-letter-b;
                               escaped for JavaScript literal to double-backslash-then-b.

So, this is fine:

"'"+escape_javascript(myvar)+"'"

alternatively, you can use a JSON encoder to create the JavaScript string literal including the surrounding quotes.

edited Jun 19, 2012 at 18:31

Tom Davies

1,8903 gold badges16 silver badges19 bronze badges

answered Jan 31, 2010 at 11:03

bobince

538k111 gold badges675 silver badges846 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Kodak Over a year ago

it has also a simple "j" alias: "'"+j(myvar)+"'"

Tom Davies Over a year ago

A note for recent readers: as of rails 3.2 (and perhaps before) the method is escape_javascript and not javascript_escape

Collectives™ on Stack Overflow

Escaping quotes from Rails Variables when using them for Javascript?

1 Answer 1

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related