Turn off double quotes in the onClick JavaScript event handler

Question

A simple block of code below can be served on a static HTML page, but leads to a JavaScript error. How should you avoid the inline double quote in the onClick handler (e.g. xyz)? Note that HTML is generated dynamically by pulling data from a database whose data is fragments of another HTML code that can have one or two quotes. It seems that adding one back slate in front of the double quote character does not do the trick.

<script type="text/javascript"> function parse(a, b, c) { alert(c); } </script> <a href="#x" onclick="parse('#', false, '<a href=\"xyz'); return false">Test</a> 

Answer 1

You tried

" or \x22

instead

 \" 

?

Answer 2

It should be escaped HTML, not Javascript escaped. Change \" to "

Answer 3

Although I agree with the CMS that you do it unobtrusively (via lib, like jquery or dojo), here's what works:

 <script type="text/javascript"> function parse(a, b, c) { alert(c); } </script> <a href="#x" onclick="parse('#', false, 'xyc&quot;foo');return false;">Test</a> 

The reason it's barfs is not because of JavaScript, but because of the HTML parser. He has no idea about the escaped quotes that he rolls around to search for the final quote and finds it and returns it as an onclick function. This is invalid javascript, although you cannot find the error until JavaScript tries to execute this function.

Answer 4

You can also try two backslashes (\\") to avoid the escape character.

Answer 5

I think the best approach is to unobtrusively assign an onclick handler .

Something like that:

 window.onload = function(){ var myLink = document.getElementsById('myLinkId'); myLink.onclick = function(){ parse('#', false, '<a href="xyz'); return false; } } //... <a href="#" id="myLink">Test</a>