My Description contains an apstrophe('). How to escape it.

<a href='javascript:select("<%= pageBean.replace(list.getColumn(0), "'", "'") %>",
"<%= pageBean.replace(list.getColumn(1), "'", "'") %>");' title="<%=selRpt%>">
<span class='img-view'></span></a>

"<%= pageBean.replace(list.getColumn(1), "'", "'") %>" is the description part in my JSP Scriptlet which contains apstrophe(')

My HTML View

    <a href='javascript:select("JWCCA5",
"Worker's Compensation Form -  California Form 5020(New)");' 
title="Select Report"><span class='img-view'></span></a>

My Description contains an apstrophe('). How to escape it.

<a href='javascript:select("<%= pageBean.replace(list.getColumn(0), "'", "'") %>",
"<%= pageBean.replace(list.getColumn(1), "'", "'") %>");' title="<%=selRpt%>">
<span class='img-view'></span></a>

"<%= pageBean.replace(list.getColumn(1), "'", "'") %>" is the description part in my JSP Scriptlet which contains apstrophe(')

My HTML View

    <a href='javascript:select("JWCCA5",
"Worker's Compensation Form -  California Form 5020(New)");' 
title="Select Report"><span class='img-view'></span></a>

• java
• javascript
• html
• jsp

• You'd think that the framework would have some way of HTML-escaping the text. Heck, even PHP can do that. – Ignacio Vazquez-Abrams Commented Oct 20, 2010 at 11:02
• By the way, don't put JavaScript into the href argument. Use the onclick event – Pekka Commented Oct 20, 2010 at 11:11
• What is the intention of the pageBean.replace() method? – irishbuzz Commented Oct 20, 2010 at 11:29
• it would replace the value coming from the DB column – John Commented Oct 20, 2010 at 11:30

7 Answers 7

For reserved HTML characters you should use HTML entities. An apostrophe is then reprecented as ':

<a href='javascript:select(
  "<%= pageBean.replace(list.getColumn(0), "'", "&#39;") %>", 
  "<%= pageBean.replace(list.getColumn(1), "'", "&#39;") %>");' title="<%=selRpt%>"> 
<span class='img-view'></span></a>

Use \'

Inside a HTML tag, you need to turn the string into HTML entities, so the quote becomes '

Inside pure JavaScript, you could also escape the quote with a \'

Usually \' should work, but it seems that sometimes you need to use '' (double apostrophe).

Try this one:

<%= pageBean.replace(list.getColumn(0), "'", "\'" %>

or:

<%= pageBean.replace(list.getColumn(0), "'", "''"

One of them should work (from my experience).

For attributes within HTML tags, I would use " (quotation mark) rather than ' (apostrophe).

Call a function from the HTML, and put your JavaScript in that function. It'll get around your problem, but I think it's slightly better practice anyways.

Maybe you could use the unicode character code instead? (\u0027)

You have to replace the ' with #39; before it is rendered.
You can do it in
- the properties file from where this is coming from
- in code in ASP

BTW, what are you trying in this line?

"<%= pageBean.replace(list.getColumn(1), "'", "'") %>" 

Perhaps

"<%= pageBean.replace(list.getColumn(1), "'", "&#39;") %>" 

should do the work.

A normal JSP developer would abandon old fashioned scriptlets and use JSTL c:out or fn:escapeXml instead. Both escapes predefined XML entities like ' to ' and so on.

Here's an example with fn:escapeXml:

<%@ taglib uri="http://java.sun.com/jsp/jstl/functions" prefix="fn" %>
...
<a href="javascript:select('${fn:escapeXml(list.columns[0])}',
    '${fn:escapeXml(list.columns[1])}');" title="${title}">

You may only need to change the model to be more a fullworthy Javabean.