js_escape() wrongly escapes too many characters

[Viper007Bond]

Using js_escape(), there is no way to output <, >, or " as they are converted to HTML entities.

Example:

<script type="text/javascript">
<?php
echo 'alert("' . js_escape('HTML \'for\' "bold": <strong>bold text!</strong>') . '");';
?>
</script>

This is the output:

alert("HTML \'for\' "bold": <strong>bold text!</strong>");

Rather than this as expected:

alert("HTML \'for\' \"bold\": <strong>bold text!</strong>");

[Viper007Bond]

Don't escape literal \n's

[markjaquith]

Punting to 2.8

[Denis-de-Bernardy]

mmm... recently, I got a validation error due to the fact that one of my scripts contained < rather than &lt;, and " rather than &quot; in a string. Maybe double check the facts, at least on quote chars?

[DD32]

@Denis-de-Bernardy: Correct, In HTML Attributes.

However, Not in <script> blocks as presented by Viper007Bond.

However, I think the js_escape() function might be mis-used in this case, In that, I thought it was designed for escaping for attribute-usage, much like attribute_escape().. though i could be wrong.

[Denis-de-Bernardy]

broken patch. :-|

[Denis-de-Bernardy]

actually, his example seems like one where it actually should get escaped.

[Viper007Bond]

Well it is called js_escape() for a reason, no? There are other functions out there for escaping HTML attributes and such.

[Viper007Bond]

Replying to Denis-de-Bernardy:

mmm... recently, I got a validation error due to the fact that one of my scripts contained < rather than &lt;, and " rather than &quot; in a string. Maybe double check the facts, at least on quote chars?

This is because you didn't use CDATA or similiar, which you need to use to ensure validation.

[Viper007Bond]

Patch refresh and simplification

[Viper007Bond]

See #9650 BTW. Might be worth deprecating js_escape() in favor of something like esc_js().

[Denis-de-Bernardy]

patch is b0rke

[Denis-de-Bernardy]

see also #7041

[Viper007Bond]

Replying to Denis-de-Bernardy:

patch is b0rke

Only due to esc_js(). The patch is still valid-ish, it just needs to affect esc_js() instead now.

[azaozz]

The js_escape()/esc_js() seem to work as expected in echoed html attributes:

echo 'onclick="' . "if ( confirm('" . esc_js(__("You are about to delete ...

Perhaps it needs an arg to specify whether to convert html special chars to entities.

[Denis-de-Bernardy]

@Viper007Bond - still current/needing a new patch, right?

[Denis-de-Bernardy]

punting per IRC discusion

[azaozz]

Seems to work properly. It is intended for escaping strings used in JS context in a tag attribute, for example:

<a onclick="alert('<?php echo esc_js($my_text); ?>'); return false;" ...

[Viper007Bond]

We should rename the function to esc_attr_js() or something then.

[nacin]

Replying to Viper007Bond:

We should rename the function to esc_attr_js() or something then.

And/or update the phpdoc: "Escapes text strings for echoing in JS, both inline (for example in onclick="...") and inside <script> tag."