javascript and html character escaping

Question

I have this problem: I have a javascript, saved in a database field, that is going to be used in a web page as a href target, e.g.

insert into table_with_links (id, url) 
       values (1, 'javascript:var url="blö blö";.....');

// run scripts that use the database values to generate web pages

// part of the generated html code:
<a href="javascript:var url='blabla';..... </a>

So far no problems. I have german letters (Umlaute - e.g. ö) in the javascript. I shouldn't save the german letters in the database, so I escape them:

insert into table_with_links (id, url) 
       values (1, 'javascript:var url="bl%F6 bl%F6";.....');

Now comes the problem - I shouldn't store the % sign in the database either, because the scripts that generate the web pages cannot handle it properly. I guess you can imagine how these scripts are 3-rd party scripts and cannot be changed.

So, my question is - can I also escape the % sign?

What database are you using? Many databases support unicode character sets. Maybe you should switch databases — jeremy, Nov 21 '12 at 15:52
it's oracle, but there are just other inconsistencies when I store the german letters. So, it is technically possible, but I should not do it. — user1414745, Nov 21 '12 at 16:00

score 2 · Accepted Answer · edited May 23 '17 at 11:43

2

did you tryed this? :

var str= "remove the %";
var str_n = str.replace("%","");

here are the basics http://www.w3schools.com/jsref/jsref_replace.asp

then you can use an array of chars to replace take a look here javascript replace globally with array

edited May 23 '17 at 11:43

Community

1
1

answered Nov 21 '12 at 16:03

itsme

48,972
96
224
345

2

IMHO, w3schools is no [credible source of reference](http://w3fools.com/) to *anything*. – Linus Kleen Nov 21 '12 at 16:05
what does it means? w3c is the standard i have no other sites for standards – itsme Nov 21 '12 at 16:09
3

w3schools are in no way affiliated with W3C. Take a moment and look at the link. – Linus Kleen Nov 21 '12 at 16:12
1

this is actually a great idea how I can trick these stupid libraries I work with. The % sign was not the problem itself, but the whole combination %F6, %E4 and so on... The solution was: var url="blpercent_signF6"; alert(unescape(url.replace("percent_sign","%"))) – user1414745 Nov 21 '12 at 16:22
well is simple example, you can do all you need with that ;) – itsme Nov 21 '12 at 16:24

score 1 · Answer 2 · answered Nov 21 '12 at 16:06

I would suggest using oracle's built in internationalization, Oracle is capable of handling special german characters:

http://docs.oracle.com/cd/B19306_01/appdev.102/b14258/u_i18n.htm

If you want to handle it on your own, I would suggest doing a string replace to some sequence you know:

var str = str.replace(/ö/g,"[german-umlaute]");

(the g at the end of /ö/g is to replace all occurrences in the string)

javascript and html character escaping

2 Answers2