How to escape single quotes in Python on a server to be used in JavaScript on a client

Question

Consider:

>>> sample = "hello'world"
>>> print sample
hello'world
>>> print sample.replace("'","\'")
hello'world

In my web application I need to store my Python string with all single quotes escaped for manipulation later in the client browsers JavaScript. The trouble is Python uses the same backslash escape notation, so the replace operation as detailed above has no effect.

Is there a simple workaround?

score 62 · Answer 1 · answered Sep 14 '10 at 11:56

62

As a general solution for passing data from Python to Javascript, consider serializing it with the json library (part of the standard library in Python 2.6+).

>>> sample = "hello'world"
>>> import json
>>> print json.dumps(sample)
"hello\'world"

answered Sep 14 '10 at 11:56

Daniel Roseman

588,541
66
880
895

5

+1 this safely takes care of backslashes, newlines and Unicode, which just hacking at the apostrophes won't. – bobince Sep 14 '10 at 15:08
1

I was trying to escape `"` characters in json...common sense strikes again. – yurisich Feb 27 '13 at 21:31
1

my python 2.7.2 doesnt serialize as such. "hello'world" is the product – Gabe Rainbow Nov 26 '13 at 20:36
2

@GabeRainbow the `'` doesn't need escaping. `"hello'world"` *is* a valid, safe JavaScript string literal. – Dan Passaro Dec 05 '14 at 17:18
@Droogans try storing it before you store it, a = json.dumps(sample), and then you can see that a = '"hello\'world"' – AlexM Aug 03 '17 at 19:37
This works, but when i want to write such json to file, it removes the escapes, regardless of the ensure_ascii flag. Any ideas maybe? – Mladen Oršolić Jun 22 '21 at 16:34

score 51 · Accepted Answer · answered Sep 14 '10 at 10:52

51

Use:

sample.replace("'", r"\'")

or

sample.replace("'", "\\'")

answered Sep 14 '10 at 10:52

Gintautas Miliauskas

7,744
4
32
34

9

This is so wrong! Try this: sample = "\\'"; sample.replace("'", "\\'") #fail! – sharjeel Jul 12 '15 at 08:02
1

`sample.replace("'", r"\'")` works for me. – Francis Bacon Sep 05 '22 at 08:30
That is not wrong. STOP TRUSTING REPL. ``` sample = "hello'world"; print(sample.replace("'", "\\'")) ``` Remember the REPL escapes quotes for you. Actual string might be different. Read __str__ vs __repr__. – pPanda_beta Mar 25 '23 at 08:31

How to escape single quotes in Python on a server to be used in JavaScript on a client

2 Answers2

Linked