Unterminated string constant

Question

My Description contains an apstrophe('). How to escape it.

<a href='javascript:select("<%= pageBean.replace(list.getColumn(0), "'", "'") %>",
"<%= pageBean.replace(list.getColumn(1), "'", "'") %>");' title="<%=selRpt%>">
<span class='img-view'></span></a>

"<%= pageBean.replace(list.getColumn(1), "'", "'") %>" is the description part in my JSP Scriptlet which contains apstrophe(')

My HTML View

    <a href='javascript:select("JWCCA5",
"Worker's Compensation Form -  California Form 5020(New)");' 
title="Select Report"><span class='img-view'></span></a>

You'd think that the framework would have some way of HTML-escaping the text. Heck, even *PHP* can do that. — Ignacio Vazquez-Abrams, Oct 20 '10 at 11:02
By the way, don't put JavaScript into the `href` argument. Use the `onclick` event — Pekka, Oct 20 '10 at 11:11

Pekka · Answer 1 · 2010-10-20T11:06:59.713

6

~~Use \'~~

Inside a HTML tag, you need to turn the string into HTML entities, so the quote becomes '

Inside pure JavaScript, you could also escape the quote with a \'

edited Oct 20 '10 at 11:06

answered Oct 20 '10 at 11:01

Pekka

442,112
142
972
1,088

1

`"` is the way to go here, HTML doesn't allow backslash escaping. @John, replace "Worker's" with "Worker"s". – Andy E Oct 20 '10 at 11:04
@John you are not specifying the language you're using, but it almost certainly has an `addslashes` function of some sort to add backslashes, or a `htmlentities` one to convert all special characters into their entity equivalents. – Pekka Oct 20 '10 at 11:04
@Andy is correct, I overlooked that this is inside HTML code, so you need to look for the entities function in your language / framework – Pekka Oct 20 '10 at 11:05

Kdeveloper · Accepted Answer · 2010-10-20T11:35:22.147

6

For reserved HTML characters you should use HTML entities. An apostrophe is then reprecented as ':

<a href='javascript:select(
  "<%= pageBean.replace(list.getColumn(0), "'", "&#39;") %>", 
  "<%= pageBean.replace(list.getColumn(1), "'", "&#39;") %>");' title="<%=selRpt%>"> 
<span class='img-view'></span></a>

edited Oct 20 '10 at 11:35

answered Oct 20 '10 at 11:30

Kdeveloper

13,679
11
41
49

Paweł Dyda · Answer 3 · 2010-10-20T11:37:30.283

2

Usually \' should work, but it seems that sometimes you need to use '' (double apostrophe).

Try this one:

<%= pageBean.replace(list.getColumn(0), "'", "\'" %>

or:

<%= pageBean.replace(list.getColumn(0), "'", "''"

One of them should work (from my experience).

For attributes within HTML tags, I would use " (quotation mark) rather than ' (apostrophe).

edited Oct 20 '10 at 11:37

answered Oct 20 '10 at 11:22

Paweł Dyda

18,366
7
57
79

It depends where your string is coming from. I assume that "Worker's Compensation form" will be placed in some properties eventually (at least it should, I wouldn't hardcode it), in such case you should escape it in properties file. Otherwise simply escape it as you code. – Paweł Dyda Oct 20 '10 at 11:28

score 1 · Answer 4 · answered Oct 20 '10 at 11:04

1

Call a function from the HTML, and put your JavaScript in that function. It'll get around your problem, but I think it's slightly better practice anyways.

answered Oct 20 '10 at 11:04

EMMERICH

3,424
2
18
14

score 1 · Answer 5 · answered Oct 20 '10 at 11:26

1

Maybe you could use the unicode character code instead? (\u0027)

answered Oct 20 '10 at 11:26

Curtis

3,931
1
19
26

I expect you could use it anywhere you've got an apostrophe that's not intended to be a delimiter. – Curtis Oct 20 '10 at 11:34

score 1 · Answer 6 · answered Oct 20 '10 at 11:31

You have to replace the ' with #39; before it is rendered.
You can do it in
- the properties file from where this is coming from
- in code in ASP

BTW, what are you trying in this line?

"<%= pageBean.replace(list.getColumn(1), "'", "'") %>"

Perhaps

"<%= pageBean.replace(list.getColumn(1), "'", "&#39;") %>"

should do the work.

score 1 · Answer 7 · edited May 23 '17 at 12:05

A normal JSP developer would abandon old fashioned scriptlets and use JSTL c:out or fn:escapeXml instead. Both escapes predefined XML entities like ' to ' and so on.

Here's an example with fn:escapeXml:

<%@ taglib uri="http://java.sun.com/jsp/jstl/functions" prefix="fn" %>
...
<a href="javascript:select('${fn:escapeXml(list.columns[0])}',
    '${fn:escapeXml(list.columns[1])}');" title="${title}">

You may only need to change the model to be more a fullworthy Javabean.

Unterminated string constant

7 Answers7