ColdFusion / Javascript Escape Single Quote

Question

I know that it will be something simple that I somehow missed, but here it is:

I have a ColdFusion application in which a user can enter text on multiple screens. I have a javascript function that checks the entered text for what is stored in the database, and a confirmation window pops up asking if they want to save or discard the changes.

If the user-entered text contains quotation marks (single or double), javascript dies completely. I need to avoid quotes while still being able to check for content matching.

I tried the escape () and replace () functions (separately and together), but nothing works.

Javascript example:

function change_question(){ var feedback = document.getElementById('feedback').value; //this is what the user has entered on the page var stored_feedback = "#trim(StoredFeedback)#"; //this is what is stored in the database; retrieved via ColdFusion if (feedback != stored_feedback) { if (confirm('You have unsaved data on the page. Do you wish to discard your changes?')) { //go to next page } } else { //go to next page } } 

Thanks.

Answer 1

Inline jsStringFormat will be hidden for JavaScript

 var stored_feedback = "#jsStringFormat(StoredFeedback)#"; 

Answer 2

I do not know ColdFusion, but according to the docs:

 var stored_feedback = #SerializeJSON( trim(StoredFeedback) )#; 

I think that you do not need to explicitly add quotes, since a string when serialized in JSON should have double quotes anyway. Again, I cannot verify this myself.

Answer 3

If you are looking for a ColdFusion solution, you probably want to use this:

 HTMLEditFormat(string) 

A string with an escaped HTML string. Return characters are deleted; Line characters are saved. Characters with special meanings in HTML are converted to HTML character objects such as>.