Escape single quotes in a string

Question

JSP:

<% final String data = "some test with ' single quotes"; %>
<script>
    var str = '<%= data %>';
<script>

The result is (JavaScript):

var str = 'some test with ' single quotes';

Uncaught SyntaxError: Unexpected identifier

How do I replace this single quote with \' to avoid a JavaScript error?

You also need to encode the double quotes, new lines, tabs and many other things.. — Juan Mendes, Mar 22 '13 at 16:34
@JuanMendes no, I don't. I need just escape single quotes. This is inline string without any line breaks — Vitalii Petrychuk, Mar 22 '13 at 16:35
@VitaliyPetrychuk Yes you do, how can you possibly control what's in the string? You should be safe and properly escape anything that needs escaping, don't add bad assumptions to the code — Juan Mendes, Mar 22 '13 at 16:40

score 6 · Accepted Answer · answered Mar 22 '13 at 16:38

6

Use escapeEcmaScript method from Apache Commons Lang package:

Escapes any values it finds into their EcmaScript String form. Deals correctly with quotes and control-chars (tab, backslash, cr, ff, etc.). So a tab becomes the characters '\\' and 't'.

The only difference between Java strings and EcmaScript strings is that in EcmaScript, a single quote and forward-slash (/) are escaped.

Example:

input string: He didn't say, "Stop!"

output string: He didn\'t say, \"Stop!\"

answered Mar 22 '13 at 16:38

VisioN

138,460
30
271
271

4

Definitely an overkill, because it also converts any non-latin alphabetic symbol into its unicode sequence (`"кириллица"` -> `"\\u043A\\u0438\\u0440\\u0438\\u043B\\u043B\\u0438\\u0446\\u0430"`). – Mikhail Batcer Oct 23 '15 at 08:07

Juan Mendes · Answer 2 · 2014-02-05T19:25:31.040

3

Remember you also need to encode the double quotes, new lines, tabs and many other things. One way to do it is using org.apache.commons.lang.StringEscapeUtils

public class JavaScriptEscapeTest {

    public static void main(String[] args) throws Exception {

        String str = FileUtils.readFileToString(new File("input.txt"));
        String results = StringEscapeUtils.escapeEcmaScript(str);
        System.out.println(results);

    }

}

input.txt

Here is some "Text" that I'd like to be "escaped" for JavaScript. I'll try a couple special characters here: \ "

output

Here is some \"Text\" that\r\nI\'d like to be \"escaped\" for JavaScript.\r\nI\'ll try a couple special characters here: \ \"

edited Feb 05 '14 at 19:25

answered Mar 22 '13 at 16:39

Juan Mendes

85,853
29
146
204

1

There is no `escapeJavaScript` method anymore. – VisioN Mar 22 '13 at 16:40
@VisoN renamed in 3.1, was there until 2.6 – Juan Mendes Mar 22 '13 at 16:44
Why did someone downvote this? It's correct if you're using org.apache.commons 2.6 (the version we were stuck at work with). Also, this question was closed linking to an answer that says the exact same thing I said... – Juan Mendes Mar 22 '13 at 21:47
I don't know who dvoted you, but I personally think that your answer should be considered at least for backwards compatibility. I doesn't worth negative grade. – VisioN Mar 22 '13 at 23:45
@VisioN Thanks for the compensatory upvote :) – Juan Mendes Mar 23 '13 at 00:42

score -1 · Answer 3 · edited May 04 '15 at 16:37

-1

Are you looking to simply double-escape your string so you actually have a \ followed by a '?

<% final String data = "some name with \\' single quote"; %>

From your JavaScript code, you can use the string replace functionality:

var str2 = str1.replace("'","\\'");

edited May 04 '15 at 16:37

Peter Mortensen

30,030
21
100
124

answered Mar 22 '13 at 16:29

Sam I am says Reinstate Monica

30,298
12
69
99

2

Data is not hardcoded. I fetch it from databese and have to replace single quotes – Vitalii Petrychuk Mar 22 '13 at 16:33
1

I don't think it's a hardcoded string the OP is worried about – Juan Mendes Mar 22 '13 at 16:33

Escape single quotes in a string

3 Answers3