Node.js: Returning proper JSON from mongoose query

Question

I have this express application with mongoDB as the database and handlebars as my server-side templating engine. I am not using AngularJS or Ajax in my application.

In one of the routes, I have to render the page as well as send over a json file from the database. However, I am not able to achieve this.

Here is code snippet the my route:

router.get('/disks', function(req, res, next) {
  places.find({"category": "disks"}, function(err, disks){
      if(err){
        throw err;
      }

       res.render('disks', 
        { 
          'risime': JSON.stringify(disks)
        });
      console.log(disks); // PROPERLY LOGS TO THE CONSOLE
  });
});

In the hbs, I am trying to capture it, but I don't even think that it is JSON.

Here is how it gets logged in the client side:

[{&quot;_id&quot;:&quot;5704630a7d4cd367f8dsdce7&quot;,&quot;name&quot;:&quot;Seagate&quot;,:&quot;This awesome Hard disk&quot;,&quot;,&quot;categories&quot;:[&quot;SDD&quot;,&quot;256GB&quot;]}]

What is the issue and how do I resolve it?

Roman · Accepted Answer · 2016-04-06 15:18:48Z

1

It's handlebars that "html escapes" your string (which is what you normally want).

if you don't want that, you can use the "triple-stash" notation, like this:

{{{risime}}}

You can read about this here: http://handlebarsjs.com/#html-escaping

answered Apr 6, 2016 at 15:18

Roman

6,5581 gold badge32 silver badges51 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

QuikProBroNa Over a year ago

Um, what are the disadvantages of ignoring the HTML escape characters?

Roman Over a year ago

Security. If the string comes from an untrusted source (eg. user input), the string could be unsafe and without any escaping it could easily contain html tags (like <script>). That could be use to attack the website with, for example, an XSS exploit.

QuikProBroNa Over a year ago

Oh, okay. But this string is coming from the database, so no issues if I escape the HTML right?

Roman Over a year ago

it depends on how the string gets into the database ;)

iblancasa · Accepted Answer · 2016-04-06 14:59:24Z

0

I think you need to add this before render:

res.type('application/json');

The client will know this is a JSON, not a HTML or a plain text and it will be shown correctly.

I hope my answer will help you.

answered Apr 6, 2016 at 14:59

iblancasa

3641 silver badge5 bronze badges

2 Comments

QuikProBroNa Over a year ago

Um, but I am also using res.render() Won't this be affected?

QuikProBroNa Over a year ago

I tried it out, this does not work with res.render(). It just displays my page as plain-text instead of a web page.

Collectives™ on Stack Overflow

Node.js: Returning proper JSON from mongoose query

2 Answers 2

4 Comments

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

4 Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related