Rails escape_javascript creates invalid JSON by escaping single quotes

The escape_javascript method in ActionView escapes the apostrophe ' as backslash apostrophe ', which gives errors when parsing as JSON.

For example, the message "I'm here" is valid JSON when printed as:

{"message": "I'm here"}

But, <%= escape_javascript("I'm here") %> outputs "I'm here", resulting in invalid JSON:

{"message": "I'm here"}

Is there a patch to fix this, or an alternate way to escape strings when printing to JSON?

Asked By: Arrel

Source

Answer #1:

Just call .to_json on a string and it will be escaped properly e.g.

"foo'bar".to_json

Answered By: Arrel

Answer #2:

I ended up adding a new escape_json method to my application_helper.rb, based on the escape_javascript method found in ActionView::Helpers::JavaScriptHelper:

JSON_ESCAPE_MAP = {
    '\'    => '\\',
    '</'    => '</',
    "
"  => '
',
    "
"    => '
',
    "
"    => '
',
    '"'     => '\"' }

def escape_json(json)
  json.gsub(/(\|</|
|[

"])/) { JSON_ESCAPE_MAP[$1] }
end

Anyone know of a better workaround than this?

Answered By: Jamie Hill

Answer #3:

I had some issues similar to this, where I needed to put Javascript commands at the bottom of a Rails template, which put strings into jQuery.data for later retrieval and use.

Whenever I had a single-quote in the string I'd get a JavaScript error on loading the page.

Here is what I did:

-content_for :extra_javascript do
  :javascript
    $('#parent_#{parent.id}').data("jsonized_children", "#{escape_javascript(parent.jsonized_children)}");

Answered By: Arrel

Answer #4:

May need more details here, but JSON strings must use double quotes. Single quotes are okay in JavaScript strings, but not in JSON.

Answered By: Shannon E.

Answer #5:

Already there is an issue in github/rails https://github.com/rails/rails/issues/8844

Fix to mark the string as html_safe

<%= escape_javascript("I'm here".html_safe) %>

or even better you can sanitize the string

<%= sanitize(escape_javascript("I'm here")) %>
<%= escape_javascript(sanitize("I'm here")) %>

Answered By: Jakob Kruse

The answers/resolutions are collected from stackoverflow, are licensed under cc by-sa 2.5 , cc by-sa 3.0 and cc by-sa 4.0 .