Using template literal with replace

Question

How do I replace something with template literals? I'm trying to pass in a character that I want replaced - in this case I'm trying to replace a specific character with an empty string.

function replace(romanNumeral, replace) {
  var newStr = romanNumeral.replace(/${replace}/g, '')
  console.log(newStr);
}

@jorahFriendzone Check out this stack overflow article. Do the split & join version, rather than regex, as you will have to worry about escaping the regex expression if you continue to use regex. https://stackoverflow.com/a/17606289/1913185 — technogeek1995, Mar 13 '19 at 19:45
@JorahFriendzone It's unclear what you are trying to do anyway. Can you post some example calls to `replace()` with the expected results? — Bergi, Mar 13 '19 at 20:10
@JorahFriendzone Maybe just `romanNumeral.replace(replace, '')`? — Bergi, Mar 13 '19 at 20:10

Adrian Theodorescu · Answer 1 · 2019-03-13T20:24:20.087

2

The short anser is:

var world = "World";
var myString = "Hello World!";
myString.replace(new RegExp(`Hello ${world}`), "Hello Earth");

// Outputs "Hello Earth!"

If the content of the string you are searching for is coming as input from the user, you might want to escape it first, so the user cannot insert special RegExp characters and manipulate your regular expression in ways you might not expect.

// Escape special RegExp characters
function escapeRegExp(string) {
  return string.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
}

var world = "World";
world = escapeRegExp(world);
var myString = "Hello World!";
myString.replace(new RegExp(`Hello ${world}`), "Hello Earth");

// Outputs "Hello Earth!"

edited Mar 13 '19 at 20:24

answered Mar 13 '19 at 19:38

Adrian Theodorescu

11,664
2
23
30

You have to escape `world` because a malicious user could send bad input to manipulate the function to change the replace. Read more here at the bottom here. https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions#Using_Special_Characters – technogeek1995 Mar 13 '19 at 19:44
You should not use a template string here. – Bergi Mar 13 '19 at 20:11
1

Thanks for the suggestion and for the edit, @technogeek1995. I altered it so it's more in line with what was asked by the OP. – Adrian Theodorescu Mar 13 '19 at 20:17
@Bergi I agree it's not the typical use case for template strings, but that's what the OP needed. – Adrian Theodorescu Mar 13 '19 at 20:19
1

@AdrianT No, the OP didn't need a template string at all. And ``new RegExp(`${world}`)`` should be replaced by just `new RegExp(world)` in any case. – Bergi Mar 13 '19 at 20:21
@Bergi I just made an edit to the code. I think this is actually what the op intends to do. See if that makes more sense. – Adrian Theodorescu Mar 13 '19 at 20:25

score 1 · Answer 2 · edited Mar 13 '19 at 19:39

1

function escapeRegExp(string) {
  return string.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'); // $& means the whole matched string
}

function replace(romanNumeral, replace) {
  var newStr = romanNumeral.replace(new RegExp(escapeRegExp(replace), 'g'), '')
  console.log(newStr);
}

replace("15551", 5)

edited Mar 13 '19 at 19:39

technogeek1995

3,185
2
31
52

answered Mar 13 '19 at 19:31

AlexOwl

869
5
11

You have to escape `replace` because a malicious user could give you bad input to manipulate the function to their advantage. Read at the bottom here. https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions#Using_special_characters – technogeek1995 Mar 13 '19 at 19:41
@technogeek1995 there is no malicious user on the clientside. – Jonas Wilms Mar 13 '19 at 19:53
@JonasWilms OP doesn't specify if this is client or server side - best to error on the side of caution. – technogeek1995 Mar 13 '19 at 19:59

Using template literal with replace

2 Answers2