-2

I need to pass a server variable's value to Javascript in classic ASP. I have written the following code in my ASP file

<%
str = "<chart caption=\"Monthly revenue for last year\" subcaption=\"Harry&#39;s SuperMart\" xaxisname=\"Month\" yaxisname=\"Revenues (In USD)\" numberprefix=\"$\" theme=\"fint\">    <set label=\"Jan\" value=\"420000\" />    <set label=\"Feb\" value=\"810000\" />    <set label=\"Mar\" value=\"720000\" />    <set label=\"Apr\" value=\"550000\" />    <set label=\"May\" value=\"910000\" />    <set label=\"Jun\" value=\"510000\" />    <set label=\"Jul\" value=\"680000\" />    <set label=\"Aug\" value=\"620000\" />    <set label=\"Sep\" value=\"610000\" />    <set label=\"Oct\" value=\"490000\" />    <set label=\"Nov\" value=\"900000\" />    <set label=\"Dec\" value=\"730000\" /></chart>"

%>
<script type="text/javascript">alert("<%=str%>")</script>

Now the problem is its always showing an alert with "<%=str%>" rather than the value of str

Sahasrangshu Guha
  • 672
  • 2
  • 11
  • 29
  • Aren't you missing a dim or var to declare the str var? – Avner May 03 '16 at 10:18
  • 1
    This may be a silly question but are you actually viewing your asp file through IIS rather than opening it locally in your browser? – John May 03 '16 at 12:17
  • 1
    Also, you've tagged this as VBScript, so presumably VBScript is your server side language. The way to escape double quotes in VBS is by entering them twice rather than using backslashes - eg `<% str = " – John May 03 '16 at 12:21
  • This might help - [ASP Classic setup issues](http://stackoverflow.com/a/22194273/692942) – user692942 May 03 '16 at 12:57
  • Also this possibly - http://stackoverflow.com/a/22477210/692942 – user692942 May 03 '16 at 12:59
  • @John The string is definitely formatted incorrectly but I'd expect that you cause a `Syntax Error`, because it doesn't the issue is likely the ASP pre-processor is never handling the page, probably because it's not registered as a HTTP Handler in IIS. – user692942 May 03 '16 at 13:07
  • 1
    Classic ASP must be served via IIS, as others has said and you ignored. It won't just run magically. – Shadow The GPT Wizard May 04 '16 at 07:29
  • @Lankymart I realise that. I sometimes point out issues which OPs will run into further down the line. I like to think it helps but maybe it just adds to the confusion – John May 04 '16 at 10:47
  • 1
    As Lankymart has been saying, the fact that the utter mess after `str =` doesn't give you an immediate syntax error is conclusive proof that you don't have ASP set up correctly. – Martha May 04 '16 at 16:52

2 Answers2

0

I use single quotes, no problem with that. So try

<script type="text/javascript">alert('<%=str%>')</script>
peter
  • 41,770
  • 5
  • 64
  • 108
  • Single quotes, double quotes both should work as they are client side and stay "as is" and both are accepted string container characters in JavaScript. The `<%=str%>` is processed server-side before anything is returned to the client. It's likely the ASP pre-processor is never processing this page and just returning `<%=str%>` as text instead of pre-processing it. – user692942 May 03 '16 at 12:53
  • @Lankymart though you are correct that using single or double quotes on an alert will both work, since the OP is injecting an ASP string variable into the alert, not a variable referencing a string, the double quotes in the ASP string variable are conflicting with the javascript start/end quotes. – Gary Richter May 03 '16 at 19:35
  • @GaryRichter sorry but your wrong, if it had anything to do with the client side the OP wouldn't just see `<%=str%>`. In fact in terms of correctly formed strings the `str` isn't constructed properly and if ASP was processing it there would be a syntax error *(because `"` in VBScript strings need to be doubled to be escaped properly, regardless of any JavaScript escaping that is present that will effect the client side)*. – user692942 May 03 '16 at 19:41
  • @Lankymart you could be correct, there could be some sort of server/configuration issue. I was able to take his code and see why his 'expected' result was failing and provide a solution, but yeah, if he's getting the alert 'value' of <%=str%> then something is definately off. – Gary Richter May 03 '16 at 19:46
0

first, ASP doesn't use slash to allow usage of a quote character, it uses two double quotes. So all instances of \" should be changed to "" to create a double quote character. Secondly, if you are doing a javascript alert that begins with a double quote, the value inside the double quote can't have them as well (because they essentially stop the string to be alerted which isn't the desired effect). In the code example above visually it looks like you are alerting <%=str%> but if you do a view source you'll see you are actually alerting the 'value' of str which creates this javascript mess:

<script type="text/javascript">alert("<chart caption="Monthly revenue for last year" subcaption="Harry&#39;s SuperMart" xaxisname="Month" yaxisname="Revenues (In USD)" numberprefix="$" theme="fint">    <set label="Jan"  value="420000" />    <set label="Feb" value="810000" />    <set label="Mar" value="720000" />    <set label="Apr" value="550000" />    <set label="May" value="910000" />    <set label="Jun" value="510000" />    <set label="Jul" value="680000" />    <set label="Aug" value="620000" />    <set label="Sep" value="610000" />    <set label="Oct" value="490000" />    <set label="Nov" value="900000" />    <set label="Dec" value="730000" /></chart>");</script>

So I'm not sure why you would want to alert that weird string but if you start/end your alert with single quotes, you won't have conflict with your ASP variable's double quotes and you will at least get the alert to work.

I tested the above changes and it alerted just fine

Gary Richter
  • 526
  • 4
  • 16
  • You wouldn't have a conflict at all if the ASP string was correctly formed. I.e `str = ""` *(`...` denotes assumed code for other attributes etc)*. – user692942 May 03 '16 at 19:46
  • Classic ASP can be written with JScript, which is a variation on JavaScript. The syntax and format in the question is just fine, the problem is, the OP is not using IIS properly. – Shadow The GPT Wizard May 04 '16 at 07:31
  • @ShadowWizard it can but I doubt they are using JScript, the statements aren't terminated with `;` for one *(it's also tagged [tag:vbscript] but that's never conclusive)*. I still think this issue comes down to the ASP Handler never executing probably due to not being setup in IIS. Also think they are deliberately using the `\"` in the string because they expect the string to displayed in JavaScript client-side, thing is for that to work they are missing `\""` to escape them in ASP first, that way just `\"` will be sent to the client. – user692942 May 04 '16 at 08:18
  • 1
    @Lankymart nope. The `;` is optional in JS, always was. The backslash is totally fine, it's just a way to include literal quotes in a string. However, OP ignore all the comments, hence I downvoted - "ask and forget" is something I just despise. (people just asking, expecting to get everything on silver plate, and never bothering to reply to answers or comments.) – Shadow The GPT Wizard May 04 '16 at 08:22
  • @ShadowWizard really? Primarily worked with VBScript so I never knew that. Also not a fan of ask and forget, seems to be happening more and more in vbscript and asp-classic now. – user692942 May 04 '16 at 08:24