Backslash does NOT escape Apostrophe

[Terry Asher]

The following script does NOT escape the Apostrophe.
Meaning when you mouseover the image the Alt tag
says this: DMACC, It and then it stops.

<SCRIPT Language="JavaS cript">
var pos = "DMACC, It\'s the Smart Thing to Do.";
document.write( "<img name=img5 id=img5 src='/homepage/dmaccstudent" +
Math.floor(Math .random() *20) +
".jpg' WIDTH=145 HEIGHT=230 border=0 ALT='"+pos+"'>" );
</SCRIPT>

Please Help! I've been struggling with
this stupid apostrophe for far too long!!!

[Douglas Crockford]

Re: Backslash does NOT escape Apostrophe

> The following script does NOT escape the Apostrophe.[color=blue]
> Meaning when you mouseover the image the Alt tag
> says this: DMACC, It and then it stops.
>
> <SCRIPT Language="JavaS cript">
> var pos = "DMACC, It\'s the Smart Thing to Do.";
> document.write( "<img name=img5 id=img5 src='/homepage/dmaccstudent" +
> Math.floor(Math .random() *20) +
> ".jpg' WIDTH=145 HEIGHT=230 border=0 ALT='" + pos + "'>");
> </SCRIPT>[/color]

So, pos contains "DMACC, It's the Smart Thing to Do."

So, "alt='" + pos + "'>" is alt='DMACC, It's the Smart Thing to Do.'> which
has an unquoted single quote in a single quote delimited string.

Generally, I like to use single quote for JavaScript strings and double quote
for HTML features. So, 'alt="' + pos + '">' is alt="DMACC, It's the Smart
Thing to Do.">

I like to use a string.quote() method that automatically escapes things, so
everything always works. So, 'alt=' + pos.quote() + '>' is alt="DMACC, It's
the Smart Thing to Do.">

A quote method can be found here:

http://www.crockford.com/javascript/remedial.html

[Lasse Reichstein Nielsen]

Re: Backslash does NOT escape Apostrophe

tlasher@dmacc.e du (Terry Asher) writes:
[color=blue]
> The following script does NOT escape the Apostrophe.
> Meaning when you mouseover the image the Alt tag
> says this: DMACC, It and then it stops.
>
> <SCRIPT Language="JavaS cript">[/color]

It's
<script type="text/javascript">
according to the HTML 4 specification.
[color=blue]
> var pos = "DMACC, It\'s the Smart Thing to Do.";
> document.write( "<img name=img5 id=img5 src='/homepage/dmaccstudent" +
> Math.floor(Math .random() *20) +
> ".jpg' WIDTH=145 HEIGHT=230 border=0 ALT='"+pos+"'>" );
> </SCRIPT>
>
> Please Help! I've been struggling with
> this stupid apostrophe for far too long!!![/color]

It is a matter of levels. You have two levels of Javascript here.
The first is the code above. The second is the string you document.write.
You want to escape the quote in the second level code.

First
var pos = "DMACC, It\'s the Smart Thing to Do.";
In this string, the "\" doesn't matter. It merely quotes the ', but
since we are inside double-quotes, that is not necessary. The content
of the resulting string is just
DMACC, It's the Smart Thing to Do.

Now, you combine this string with other strings and write it to a
document. What is written is (with the random giving, e.g., 17):
<img name=img5 id=img5 src='/homepage/dmaccstudent17. jpg'
WIDTH=145 HEIGHT=230 border=0 ALT='DMACC, It's the Smart Thing to Do.'>");
(I broke the line to make room). And the quotes aren't matched.

What you need is for the document.write to write a backslash before
the quote. To do that, you must include a backslash in the string value.
That means that the string literal must include an escaped backslash:
var pos = "DMACC, It\\'s the Smart Thing to Do.";

Good luck
/L
--
Lasse Reichstein Nielsen - lrn@hotpop.com
Art D'HTML: <URL:http://www.infimum.dk/HTML/randomArtSplit. html>
'Faith without judgement merely degrades the spirit divine.'

[Terry Asher]

Re: Backslash does NOT escape Apostrophe

"Douglas Crockford" <nospam@laserli nk.net> wrote in message news:<bj4quj$4f n$1@sun-news.laserlink. net>...[color=blue][color=green]
> > The following script does NOT escape the Apostrophe.
> > Meaning when you mouseover the image the Alt tag
> > says this: DMACC, It and then it stops.
> >
> > <SCRIPT Language="JavaS cript">
> > var pos = "DMACC, It\'s the Smart Thing to Do.";
> > document.write( "<img name=img5 id=img5 src='/homepage/dmaccstudent" +
> > Math.floor(Math .random() *20) +
> > ".jpg' WIDTH=145 HEIGHT=230 border=0 ALT='" + pos + "'>");
> > </SCRIPT>[/color]
>
> So, pos contains "DMACC, It's the Smart Thing to Do."
>
> So, "alt='" + pos + "'>" is alt='DMACC, It's the Smart Thing to Do.'> which
> has an unquoted single quote in a single quote delimited string.
>
> Generally, I like to use single quote for JavaScript strings and double quote
> for HTML features. So, 'alt="' + pos + '">' is alt="DMACC, It's the Smart
> Thing to Do.">
>
> I like to use a string.quote() method that automatically escapes things, so
> everything always works. So, 'alt=' + pos.quote() + '>' is alt="DMACC, It's
> the Smart Thing to Do.">
>
> A quote method can be found here:
> http://www.crockford.com/javascript/remedial.html[/color]


Thanks much. Didn't try the quote method but turned my single and
double quotes around and I didn't even use the backslash
and it worked like this:
var pos = "DMACC, It's the Smart Thing to Do.";
document.write( '<img name=img5 id=img5 src="/homepage/dmaccstudent' +
Math.floor(Math .random() *20) +
'.jpg" WIDTH=145 HEIGHT=230 border=0 ALT="' + pos + '">');