I had always believed that jsstringformat did absolutely everything
necessary to string of text in order to set it into a JavaScript string
variable.
I realized last night I was wrong.
The following HTML example will error:
<script LANGUAGE="JavaScript" TYPE="text/javascript">
alert('</script>');
</script>
Even though the text "</script>" is a perfectly escaped JavaScript
string-the browser apparently parses the tags BEFORE the JavaScript and
prematurely ends the "real" script block.
I noticed this when playing with an interface which cfsavecontents a
display file, and then sets its contents into a JavaScript variable so
it can later be pushed as the innerHTML to a floating DIV without
hitting the server.
Please suppress the urge to ask "why". It's an experiment, and yes I
realize JavaScript is NOT evaluated when innerHTML'd. We have developed
some nifty JS regex to parse out all the JavaScript and eval it into
existence so the framework can be agnostic in that manner.
At any rate, I said that to say this:
Here was my quick solution:
<script LANGUAGE="JavaScript" TYPE="text/javascript">
var my_js_string =
'#replacenocase(jsstringformat(cf_var_containting_html),"script","scr'+'
ipt","all")#';
</script>
But, should I have to do that? If jsstringformat's job could be loosely
defined as handling ALL escaping of a string to make it save for
JavaScript, should it handle ending script tags as well since those
obviously aren't safe?
I am willing to accept the fact that escaping script tags might be out
of scope (and difficult) for the jsstringformat function, but I wanted
to hear your thoughts first.
~Brad
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
Adobe® ColdFusion® 8 software 8 is the most important and dramatic release to
date
Get the Free Trial
http://ad.doubleclick.net/clk;160198600;22374440;w
Archive:
http://www.houseoffusion.com/groups/CF-Talk/message.cfm/messageid:295589
Subscription: http://www.houseoffusion.com/groups/CF-Talk/subscribe.cfm
Unsubscribe:
http://www.houseoffusion.com/cf_lists/unsubscribe.cfm?user=11502.10531.4
