问题:

I have a user form. If the user types in a string with ' or " as part of it I have no problem. The form is submitted and saved correctly to the database. My problem is when I reload the page (all entries can be modified and are loaded into a list in the JSP before being displayed). On loading the page I get an error saying:

missing ) after argument list 'Caroline's message', \n

What do I need to do to escape this string for displaying it on the frontend?

Here is the code I am using on the frontend to read in the data and store it in a JavaScript object. I am not fully sure where I need to escape. The field causing the problem is c.getComName:

communications[][1] = new CommObject('', '');

UPDATED WITH HTML GENERATED:

communications[0][1] = new CommObject('101', 'Caroline's Message');

回答1:

Use the Apache StringEscapeUtils.escapeJavaScript function.

Escapes the characters in a String using JavaScript String rules.  Escapes any values it finds into their JavaScript String form. Deals correctly with quotes and control-chars (tab, backslash, cr, ff, etc.)  So a tab becomes the characters '\\' and 't'.

回答2:

I prefer to avoid scriptlets in the middle of my page and was having to use them (increasingly often) to escape strings when used in JavaScript code. I wanted an Expression Language (EL) way of escaping the strings. I created a very small custom taglib that I use for just this purpose:

Utilities.java:

package com.mycom.taglibs;  import org.apache.commons.lang.StringEscapeUtils;  public class Utilities {     public static String escapeJS(String value) {         return StringEscapeUtils.escapeJavaScript(value);     } }

mytaglib.tld:

My Tag LibraryTag Utils1.1myt         JavaScript Escape function     escapeJScom.mycom.taglibs.Utilitiesjava.lang.String escapeJS(java.lang.String)

And, in the JSP page:

 The escaped string is: ${myt:escapeJS(variableHoldingTheString)}

回答3:

fn:escapeXml does not work in JavaScript. It replaces ' with #&0039; still causing an error when the JavaScript is executed.

Only escaping in the JavaScript manner is correct: \'

The the Apache StringEscapeUtils.escapeJavaScript function does this for you. Creating a taglib for it greatly simplyfies matters.

回答4:

When you return the HTML from the CommObject class add in the \" instead of the ' and before the name (e.g. Caroline's message)

Like this: return "\"" + comName + "\"";

回答5:

You can use the JSTL escape function fn:escapeXml() to get rid of anomalies caused due to single quotes(`). The following example demonstrates the difference.

For example:

With escapeXml() Function:
 string (1): ${fn:escapeXml(string1)}
  Without escapeXml() Function:
 string (2): ${fn:escapeXml(string2)}

RESULT

string (1): This is abc s first String.

string (2): This is abc's second String.

回答6:

Also we have very nice solution from Spring:

So, issue from the question of this post can be resolved in this way:

communications[][1] = new CommObject('', '');

回答7:

That's strange.

What about:

''

If that works, you just have to figure out how to add the \".

回答8:

You could use JSP core tags:

       var jsVar = "";

转载请标明出处:How to escape apostrophe or quotes on a JSP (used by JavaScript)

文章来源: How to escape apostrophe or quotes on a JSP (used by JavaScript)

标签

string

escape

javascript