Escape Quotes In HTML5 Data Attribute Using Javascript

Question

I'm using jQuery's .data() to work with custom HTML5 data attributes where the value of the attribute needs to be able to contain both single quotes and double quotes:

<p class="example" data-example="She said "WTF" on last night's show.">

I know using character codes like " in the data attribute value could make the above work, but I can't always control how the values are inputted. Plus, I need to be able to use HTML tags in the markup, like this:

<p class="example" data-example="
She said "<abbr title="What The F***">WTF</abbr>" on last night's show.
">

If some form of .replace() is the answer, then it needs to be done before the value is read by .data()—maybe by applying it across the entire <body>?

Normal backslash escaping like <abbr title="te\'st">WTF</abbr> doesn't work either.

Ideally this would have the flexibility to work w/ both:

data-example="..." and data-example='...'

But if it's only possible one way then I could at least roll with that. Ideas?

Update - some more context:

I'm working on this for responsejs.com. An actual application of this might be to only load a sidebar for browsers above a certain width (and have this handled in the browser rather than PHP). In the case of WordPress for example, the sidebar could contain widgets, images, etc. The quotes within PHP tags are a non-issue b/c they are parsed into HTML before they get to the browser. Example:

<aside id="primary" class="sidebar" 

        data-oweb=' 

            <?php dynamic_sidebar( 'primary' ); ?>

        '
    >

    optional default markup for mobile and no-js browsers here

</aside>

JavaScript will not help you after the page has rendered to fix the quotes of the tag. Has to be done on the serverside. — epascarello
– epascarello, Commented Aug 31, 2011 at 16:52

Guffa · Accepted Answer · 2011-08-31 17:34:26Z

41

There is no way around it, you have to escape the values properly, or the HTML can't be parsed properly. You can't use Javascript to correct the code after it is parsed, because then it has already failed.

Your example with proper HTML encoding would be:

<p class="example" data-example="She said &quot;&lt;abbr title=&quot;What The F***&quot;&gt;WTF&lt;/abbr&gt;&quot; on last night's show.">

You can't use backslash to escape characters, because it's not Javascript code. You use HTML entities to escape characters in HTML code.

If you can't control how the data is input, then you are screwed. You simply have to find a way to take control over it.

answered Aug 31, 2011 at 17:34

Guffa

703k111 gold badges760 silver badges1k bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Roy Shoa Over a year ago

Use htmlspecialchars() with ENT_QUOTES to print it e.g. <?php echo(htmlspecialchars($myValue,ENT_QUOTES)) ?> For more info: php.net/manual/en/function.htmlspecialchars.php

somedotnetguy Over a year ago

note, that in chrome dev tools, if you just edit a html element and give it a custom attribute like data-foo="she said "WTF"" then you press enter, chrome will display it in dev tools like data-foo="she said "WTF"" (or when your framework has generated it like that for you already correctly) (when you double click it for copying you see the html entities again) ...for those how happen to fall for the same confusion as me

Dan Smith · Accepted Answer · 2015-03-06 22:35:01Z

9

Use encodeURI to escape quotation marks in your JSON object. Parse the string with decodeURI.

var popup = document.getElementById('popup'),
    msgObj = JSON.parse(decodeURI(popup.dataset.message));

console.log(msgObj);

<a id="popup" href="#" data-message="%7B%22title%22:%22Print%22,%22message%22:%22Printing%20not%20yet%20implemented%22%7D" />

answered Mar 6, 2015 at 22:35

Dan Smith

6436 silver badges3 bronze badges

2 Comments

Ezequias Lopes Over a year ago

Quite a neat solution.

daggett Over a year ago

underrated solution - this works neatly

user7006253 · Accepted Answer · 2018-01-16 12:25:22Z

4

As I use the data attribute to transport some data together with the html element from PHP to the JavaScript, I just use base64_encode on the backend , then on the client side use base64Decode(input) to get the data back. This way I avoid any and all escaping orgy. The JavasScript code I use is located here http://www.webtoolkit.info/

answered Jan 16, 2018 at 12:25

user7006253

Comments

pimvdb · Accepted Answer · 2011-08-31 16:53:48Z

3

If they have to be HTML strings with " and ' and whatnot, why not just make separate HTML elements for them: http://jsfiddle.net/N7XXu/.

E.g. the HTML:

<p class="example" data-which="1">a</p>

<p class="example-data" data-which="1">She said "<abbr title="What The F***">WTF</abbr>" on last night's show.</p>

in combination with the following JavaScript:

$('.example').each(function() {
    var correspondingElem = $('.example-data[data-which="'
                              + $(this).data('which')
                              + '"]');
    $(this).data('example', correspondingElem.html());
});

alert($('.example').data('example'));

Of course, hide the .example-data elements.

answered Aug 31, 2011 at 16:53

pimvdb

155k80 gold badges313 silver badges358 bronze badges

1 Comment

ryanve Over a year ago

Thanks—that's cool but for what I need this for it won't fly. I just updated the question with some more context.

Dieter Gribnitz · Accepted Answer · 2014-04-27 09:44:08Z

Here is a simple tool I created you can use to encode html:

The trick is to escape it twice.

I added an additional \n replace to preserve multiline text since it gets discarded by text().

In addition you need to escape the quotes to make it safe for a data attribute.

<div id="esc"></div>
<textarea id="escinput" placeholder="Enter text"></textarea>
<script>
    $("#escinput").bind("change paste keyup", function(){
        $("#esc").text($(this).val().replace(/\n/g,'\\n'));
        $("#esc").text($("#esc").html().replace(/"/g, '&quot;'));
    });            
</script>

This should create a data attribute safe string.

You can test it here: http://jsfiddle.net/SplicePHP/n6HFq/

To decode it back to html simply use:

<script>
    var attr = $("#idOfElement").data('attribute');
    var decoded = $('<textarea/>').html(attr).val();
</script>

DA. · Accepted Answer · 2011-08-31 16:25:48Z

1

For it to be proper html, you have to escape the troublesome characters. I'd escape them with HTML entities. This means that whatever tool is being used to input this information would have have to store them properly and/or the tool retrieving them on the back end would have to escape them.

Then if you want to use them in your JS, you'd have to run some find-and-replace functions to convert the characters back into HTML and quotes.

Most back-end dev languages have some sort of 'htmlescape/unescape' functionality, so that shouldn't be to hard.

To unescape it via jQuery, here's something found via a quick Google: http://www.naveen.com.au/javascript/jquery/encode-or-decode-html-entities-with-jquery/289

answered Aug 31, 2011 at 16:25

DA.

40.8k51 gold badges162 silver badges219 bronze badges

1 Comment

shesek Over a year ago

There's need to replace the encoded characters back - the attribute value, when accesses via js, is already normalized back to plain text

Gabriel Berchmann · Accepted Answer · 2022-07-15 09:42:06Z

1

have you tried using single quotes for your data?

Like this:

<p class="example" data-example='She said "WTF" on last night's show.'>

answered Jul 15, 2022 at 9:42

Gabriel Berchmann

5691 gold badge4 silver badges10 bronze badges

Comments

Yasser CHENIK · Accepted Answer · 2022-09-09 09:25:56Z

1

As this answer suggestest , here is a possible solution :

var popup = $('#placeholder');
popup.html(`
<div data-message="${encodeURI("i could be what ever you need \' \" i will escape ! ")}" >
</div>
`);

console.log(decodeURI(popup.find('div').data("message")));

<script src="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.min.js"></script>

<div id="placeholder">
</div>

The key here is that :

wierdText = decodeURI(someText))

and :

someText = encodeURI(wierdText)

are reverse functions and can hold what ever string you need without causing it to be interpreted as html nor html attribut because it's used in inline href tag , it was made to do this job.

answered Sep 9, 2022 at 9:25

Yasser CHENIK

4051 gold badge7 silver badges19 bronze badges

Comments

fozuse · Accepted Answer · 2017-03-07 14:42:10Z

0

It is a little bit tricky but you can select dom objects with their data attributes that contains single quotes. The trick is \\'

<div id="text" data-message="Stanley Kubrick's Oranges">Hello</div>

<script>
    var message = "Stanley Kubrick\\'s Oranges";
    $("#text[data-message='"+message+"']").fadeOut("slow");
</script>

Fiddle

answered Mar 7, 2017 at 14:42

fozuse

7862 gold badges12 silver badges30 bronze badges

Comments

rajesh kumar · Accepted Answer · 2020-04-19 19:26:09Z

-1

If you are using Lodash, then you can use _.escape() and _.unescape(). It converts the characters "&", "<", ">", '"', and "'" in string to their corresponding HTML entities.

Reference : https://lodash.com/docs/#escape

answered Apr 19, 2020 at 19:26

rajesh kumar

1,9081 gold badge18 silver badges16 bronze badges

Comments

Paul Sweatte · Accepted Answer · 2016-06-17 13:42:48Z

-2

Use the btoa method to set the data and the atob method to get it:

 $(document).data("test2",btoa('She said "<abbr title="What The F***">WTF<\/abbr>" on last nights show.">'))

Or simply dereference the string as a variable:

 var stringer = 'She said "<abbr title="What The F***">WTF<\/abbr>" on last nights show.">'

 $(document).data("test2",stringer);

References

HTML5 Living Standard, Web application APIs: Base64 utility methods

edited Jun 17, 2016 at 13:42

answered Aug 28, 2012 at 14:33

Paul Sweatte

24.7k7 gold badges131 silver badges270 bronze badges

Collectives™ on Stack Overflow

Escape Quotes In HTML5 Data Attribute Using Javascript

11 Answers 11

2 Comments

2 Comments

Comments

1 Comment

Comments

1 Comment

Comments

Comments

Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

11 Answers 11

2 Comments

2 Comments

Comments

1 Comment

Comments

1 Comment

Comments

Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related