Escaping html / javascript: Appending content of db field into DOM with jQuery

Question

I want to do the following within rails. In a textfield of my db, there is the following html / javascript:

<script type="text/javascript">
  document.write('<div id="test"></div>');
</script>

I want to append the contents of this field into the head-tag of the DOM, so the inserted js will be executed.

In my rails erb-view, I have the following:

<script type="text/javascript">
  var code = "<%= @ticket.code %>"; // Content of codesnippet above
  $('head').append(code);
</script>

However I get some the following rendered output of the view:

var code = "&lt;script type=&quot;text/javascript&quot;&gt;
  document.write('&lt;div id=&quot;test&quot;&gt;&lt;/div&gt;');
&lt;/script&gt;";

Error message: unterminated string literal

I tried to gsub linebreaks and other ways of escaping, but I've got no clue, what actually is the best way to escape it. How can I get it correclty escaped and inserted into the DOM?

Thanks for your help!

Travis Pessetto · Accepted Answer · 2012-06-21 16:39:39Z

1

I believe rails 3 comes with JQuery so why not just use:

$(document).onload(function()
{ 
    document.write('<div id="test"></div>');
});

and I believe on var code you should do the following:

var code = "<%= escape_javascript(@ticket.code.html_safe) %>"

edited Jun 21, 2012 at 16:39

answered Jun 21, 2012 at 16:21

Travis Pessetto

3,2984 gold badges29 silver badges56 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

algi Over a year ago

using html_safe is producing another problem: var code = "<script type="text/javascript"> document.write('<div id="test"></div>'); </script>"; The quotation marks now make the variable declaration end too soon.

Travis Pessetto Over a year ago

@agieche then try var code = "<%= escape_javascript(@ticket.code.html_safe) %>"

algi Over a year ago

Yeah, this worked smoothly. Thanks! Please edit your answer, so I can mark it as correct.

Collectives™ on Stack Overflow

Escaping html / javascript: Appending content of db field into DOM with jQuery

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related