It shouldn't do that. It formats a string, and all of those characters are
valid characters within a JS string. You wouldn't want to do anything
special if you were serving a JS file out to the browser; it's only when
you're serving JS embedded in an HTML file that you need to worry about
</script> tags in the strings. So it's a response assembly problem, not a
string formatting problem.
cheers,
barneyb
On Dec 31, 2007 10:55 AM, Brad Wood <[EMAIL PROTECTED]> wrote:
> I had always believed that jsstringformat did absolutely everything
> necessary to string of text in order to set it into a JavaScript string
> variable.
>
> I realized last night I was wrong.
>
>
>
> The following HTML example will error:
>
>
>
> <script LANGUAGE="JavaScript" TYPE="text/javascript">
>
> alert('</script>');
>
> </script>
>
>
>
> Even though the text "</script>" is a perfectly escaped JavaScript
> string-the browser apparently parses the tags BEFORE the JavaScript and
> prematurely ends the "real" script block.
>
> I noticed this when playing with an interface which cfsavecontents a
> display file, and then sets its contents into a JavaScript variable so
> it can later be pushed as the innerHTML to a floating DIV without
> hitting the server.
>
> Please suppress the urge to ask "why". It's an experiment, and yes I
> realize JavaScript is NOT evaluated when innerHTML'd. We have developed
> some nifty JS regex to parse out all the JavaScript and eval it into
> existence so the framework can be agnostic in that manner.
>
>
>
> At any rate, I said that to say this:
>
> Here was my quick solution:
>
>
>
> <script LANGUAGE="JavaScript" TYPE="text/javascript">
>
> var my_js_string =
> '#replacenocase(jsstringformat(cf_var_containting_html),"script","scr'+'
> ipt","all")#';
>
> </script>
>
>
>
> But, should I have to do that? If jsstringformat's job could be loosely
> defined as handling ALL escaping of a string to make it save for
> JavaScript, should it handle ending script tags as well since those
> obviously aren't safe?
>
> I am willing to accept the fact that escaping script tags might be out
> of scope (and difficult) for the jsstringformat function, but I wanted
> to hear your thoughts first.
>
>
>
> ~Brad
>
>
>
>
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
Adobe® ColdFusion® 8 software 8 is the most important and dramatic release to
date
Get the Free Trial
http://ad.doubleclick.net/clk;160198600;22374440;w
Archive:
http://www.houseoffusion.com/groups/CF-Talk/message.cfm/messageid:295590
Subscription: http://www.houseoffusion.com/groups/CF-Talk/subscribe.cfm
Unsubscribe:
http://www.houseoffusion.com/cf_lists/unsubscribe.cfm?user=11502.10531.4
