js_escape() wrongly escapes too many characters

[Viper007Bond]

Using js_escape(), there is no way to output <, >, or " as they are converted to HTML entities.

Example:

<script type="text/javascript">
<?php
echo 'alert("' . js_escape('HTML \'for\' "bold": <strong>bold text!</strong>') . '");';
?>
</script>

This is the output:

alert("HTML \'for\' "bold": <strong>bold text!</strong>");

Rather than this as expected:

alert("HTML \'for\' \"bold\": <strong>bold text!</strong>");

Don't escape literal \n's

Punting to 2.8

mmm... recently, I got a validation error due to the fact that one of my scripts contained < rather than &lt;, and " rather than &quot; in a string. Maybe double check the facts, at least on quote chars?

@Denis-de-Bernardy: Correct, In HTML Attributes.

However, Not in <script> blocks as presented by Viper007Bond.

However, I think the js_escape() function might be mis-used in this case, In that, I thought it was designed for escaping for attribute-usage, much like attribute_escape().. though i could be wrong.

broken patch. :-|

actually, his example seems like one where it actually should get escaped.

Well it is called js_escape() for a reason, no? There are other functions out there for escaping HTML attributes and such.

Replying to Denis-de-Bernardy:

mmm... recently, I got a validation error due to the fact that one of my scripts contained < rather than &lt;, and " rather than &quot; in a string. Maybe double check the facts, at least on quote chars?

This is because you didn't use CDATA or similiar, which you need to use to ensure validation.

Patch refresh and simplification

See #9650 BTW. Might be worth deprecating js_escape() in favor of something like esc_js().

patch is b0rke

see also #7041

Replying to Denis-de-Bernardy:

patch is b0rke

Only due to esc_js(). The patch is still valid-ish, it just needs to affect esc_js() instead now.

The js_escape()/esc_js() seem to work as expected in echoed html attributes:

echo 'onclick="' . "if ( confirm('" . esc_js(__("You are about to delete ...

Perhaps it needs an arg to specify whether to convert html special chars to entities.

@Viper007Bond - still current/needing a new patch, right?

punting per IRC discusion

Seems to work properly. It is intended for escaping strings used in JS context in a tag attribute, for example:

<a onclick="alert('<?php echo esc_js($my_text); ?>'); return false;" ...

We should rename the function to esc_attr_js() or something then.

Replying to Viper007Bond:

We should rename the function to esc_attr_js() or something then.

And/or update the phpdoc: "Escapes text strings for echoing in JS, both inline (for example in onclick="...") and inside <script> tag."