HTML and JS Escaping HowTo

What is escaping ? Escaping is a way to differentiate between characters used as part of syntax of a language and data. Eg: Java: String name="My name is \""; Javascript: Var name= "My name is \""; Html :

HTML Escaping Reserved Characters in HTML HTML and XHTML processors must support the five special characters listed in the table below: CharacterEntity NumberEntity NameDescription """quotation mark ''&apos;apostrophe &&&ampersand <<<less-than >>>greater-than

Javascript Escaping in Javascript you can use single quote(') or double quote as delimiter for strings. So If you have either double quote or single quote in the value it should be escaped as follows var iAmSingleQuote='\''; var iAmDoubleQuote="\"";

HTML & JS Escaping In case we need Both javascript HTML escaping do javascript escaping first and then do HTML Escaping Original Corrected with HTML and Javascript escaping

URL Encoding Why :RFC 1738: Uniform Resource Locators (URL) specification The specification for URLs (RFC 1738, Dec. '94) limits the use of allowed characters in URLs to only a limited subset of the US-ASCII character set: "...Only alphanumerics [0-9a-zA-Z], the special characters "$-_.+!*'()," [not including the quotes - ed], and reserved characters used for their reserved purposes may be used unencoded within a URL." URL encoding of a character consists of a "%" symbol, followed by the two- digit hexadecimal representation (case-insensitive) of the ISO-Latin code point for the character.ISO-Latin Eg : Use the javascript method encodeURIComponent() to encode all parameter values in URLs and encodeURI() to encode the whole URL. escape() method in javascript is deprecated and shouldn't be used.

Recommendation: HTML Escaping Use standard tag libraries like JSTL and Spring Tags.They handle escaping by default.They have boolean attributes related to escaping which are by default true. Eg : Spring form tag JSTL out tag

Recommendation: Javascript Escaping Get values from the Dom as much as possible and avoid assigning values from server side

Reference htm