Escape single quotes in a string

Question

JSP:

<% final String data = "some test with ' single quotes"; %>
<script>
    var str = '<%= data %>';
<script>

The result is (JavaScript):

var str = 'some test with ' single quotes';

Uncaught SyntaxError: Unexpected identifier

How do I replace this single quote with \' to avoid a JavaScript error?

You also need to encode the double quotes, new lines, tabs and many other things.. — Ruan Mendes, Mar 22 '13 at 16:34
@JuanMendes no, I don't. I need just escape single quotes. This is inline string without any line breaks — Vitalii Petrychuk, Mar 22 '13 at 16:35
@VitaliyPetrychuk Yes you do, how can you possibly control what's in the string? You should be safe and properly escape anything that needs escaping, don't add bad assumptions to the code — Ruan Mendes, Mar 22 '13 at 16:40

score 6 · Accepted Answer · answered Mar 22 '13 at 16:38

6

Use escapeEcmaScript method from Apache Commons Lang package:

Escapes any values it finds into their EcmaScript String form. Deals correctly with quotes and control-chars (tab, backslash, cr, ff, etc.). So a tab becomes the characters '\\' and 't'.

The only difference between Java strings and EcmaScript strings is that in EcmaScript, a single quote and forward-slash (/) are escaped.

Example:

input string: He didn't say, "Stop!"

output string: He didn\'t say, \"Stop!\"

answered Mar 22 '13 at 16:38

VisioN

143,310
32
282
281

4

Definitely an overkill, because it also converts any non-latin alphabetic symbol into its unicode sequence (`"кириллица"` -> `"\\u043A\\u0438\\u0440\\u0438\\u043B\\u043B\\u0438\\u0446\\u0430"`). – Mikhail Batcer Oct 23 '15 at 08:07

Ruan Mendes · Answer 2 · 2014-02-05T19:25:31.040

3

Remember you also need to encode the double quotes, new lines, tabs and many other things. One way to do it is using org.apache.commons.lang.StringEscapeUtils

public class JavaScriptEscapeTest {

    public static void main(String[] args) throws Exception {

        String str = FileUtils.readFileToString(new File("input.txt"));
        String results = StringEscapeUtils.escapeEcmaScript(str);
        System.out.println(results);

    }

}

input.txt

Here is some "Text" that I'd like to be "escaped" for JavaScript. I'll try a couple special characters here: \ "

output

Here is some \"Text\" that\r\nI\'d like to be \"escaped\" for JavaScript.\r\nI\'ll try a couple special characters here: \ \"

edited Feb 05 '14 at 19:25

answered Mar 22 '13 at 16:39

Ruan Mendes

90,375
31
153
217

1

There is no `escapeJavaScript` method anymore. – VisioN Mar 22 '13 at 16:40
@VisoN renamed in 3.1, was there until 2.6 – Ruan Mendes Mar 22 '13 at 16:44
Why did someone downvote this? It's correct if you're using org.apache.commons 2.6 (the version we were stuck at work with). Also, this question was closed linking to an answer that says the exact same thing I said... – Ruan Mendes Mar 22 '13 at 21:47
I don't know who dvoted you, but I personally think that your answer should be considered at least for backwards compatibility. I doesn't worth negative grade. – VisioN Mar 22 '13 at 23:45
@VisioN Thanks for the compensatory upvote :) – Ruan Mendes Mar 23 '13 at 00:42

score -1 · Answer 3 · edited May 04 '15 at 16:37

-1

Are you looking to simply double-escape your string so you actually have a \ followed by a '?

<% final String data = "some name with \\' single quote"; %>

From your JavaScript code, you can use the string replace functionality:

var str2 = str1.replace("'","\\'");

edited May 04 '15 at 16:37

Peter Mortensen

30,738
21
105
131

answered Mar 22 '13 at 16:29

Sam I am says Reinstate Monica

30,851
12
72
100

2

Data is not hardcoded. I fetch it from databese and have to replace single quotes – Vitalii Petrychuk Mar 22 '13 at 16:33
1

I don't think it's a hardcoded string the OP is worried about – Ruan Mendes Mar 22 '13 at 16:33

Escape single quotes in a string

3 Answers3