Single quote in the URL parameter doesnt get replaced and encoded

Question

In my code i'm trying to get a value that is set using a modelAttribute in a Spring controller and then pass it to Javascript function and set the value as a parameter in URL.

modelAttribute from the controller :

model.addAttribute("appName",appName); model.addAttribute("cloverAppType", cloverAppType);

the javascript in the view :

 <a data-toggle="tab" onclick="loadOrders()">Orders</a>

  function loadOrders() {
    var message = "${appName}".replace(/'/g, "%27");
    var x = encodeURIComponent(message);
    window.location = '/admin/business/${businessId}/order?cloverAppType=${cloverAppType}&appName='+x;
   }

The issue is when a ' is included in the appName it breaks the javascript and give the Uncaught SyntaxError: Unexpected identifier and Uncaught ReferenceError: loadOrders is not defined at HTMLAnchorElement.onclick errors on the browser console.

But if I hardcode the value Poppo's Taqueria - Outpost its being replaced and encoded.

How can I avoid this and pass the appName value with the ' character as a aparameter of the URL?

try to `encode` first and then `replace`. Because if you replace before encode it also encode your `%` add in replace — Harish, Apr 10 '19 at 10:37
I would take care of escaping in the EL expressions. For URL encoding use `c:url`. — Jasper de Vries, Apr 10 '19 at 11:10
https://stackoverflow.com/questions/15923062/how-to-url-encode-a-url-in-jsp — Jasper de Vries, Apr 10 '19 at 11:11
https://stackoverflow.com/questions/9708242/how-to-escape-javascript-in-jsp — Jasper de Vries, Apr 10 '19 at 11:12
@JasperdeVries I cant find the escapeJS function in the tag library — GeekySelene, Apr 10 '19 at 12:47
You need to escape the single quotes in the URL to use it in a JavaScript string. There is no tag library. Please read the answer to that question carefully. You need to create a custom EL function as explained if you would like to take that route. — Jasper de Vries, Apr 10 '19 at 13:23

score 0 · Answer 1 · answered Apr 10 '19 at 10:35

0

change

var message = "${appName}".replace(/'/g, "%27");

to

var message = `${appName}`.replace(/'/g, "%27");

answered Apr 10 '19 at 10:35

Alex

11
3

sorry it doesn't fix. – GeekySelene Apr 10 '19 at 10:41
Can you share the entire script? – Alex Apr 10 '19 at 10:44
Where this "appName" comes from? Can you give one example value? – Alex Apr 10 '19 at 10:53
'Poppo's Taqueria - Outpost ' is an example value. Its just a String value with single quote – GeekySelene Apr 10 '19 at 10:55

Single quote in the URL parameter doesnt get replaced and encoded

1 Answers1