about text substitution.

[SpreadTooThin]

I have an application that takes some user input and then at a later
date displays that in a hover over pop up.

The jquery script
<script type="text/javascript" src="https://ajax.googleapis.com/ajax/
libs/prototype/1.7.0.0/prototype.js"></script>
<script type="text/javascript" src="https://swort.eu/library/prototip/
js/prototip/prototip.js"></script>
<link rel="stylesheet" media="all" href="https://swort.eu/library/
prototip/css/prototip.css"/>

The basic application when it gets a mouse enter event takes that
user input and passes it to the jquery like this:

ExecuteJavaScript("new Tip('"+_
me.ControlID +_
"', '" + GetContentString + "', {"+_
"title: '" + GetTitleString + "',"+_
"style: 'protoblue',"+_
"stem: 'topLeft',"+_
"hook: { tip: 'topLeft', mouse: true },"+_
"offset: { x: 14, y: 14 }"+_
"});")


There are some strings that really mess this up. If one of the
characters is a " or a ' then the javascript throws an exception.

How can I preprocess these user entered strings so that I don't get
these execptions thrown?

i.e. can I put a \ in front of the " or the ' so that it is
interpreted literally?
Are there any other characters that will need special pre-processing?

 

[Jukka K. Korpela]

I have an application that takes some user input and then at a later
date displays that in a hover over pop up.

This would be much easier to analyze if the URL of an online version had
been included.

The basic application when it gets a mouse enter event takes that
user input and passes it to the jquery like this:

ExecuteJavaScript("new Tip('"+_

This sounds like a complicated and risky way of doing something fairly
simple. Anyway, your problem, in the current approach, is basically a
JavaScript problem, not HTML

There are some strings that really mess this up. If one of the
characters is a " or a ' then the javascript throws an exception.

Or maybe executes code injected by the intruder, through the huge
security hole that you have built.

Are there any other characters that will need special pre-processing?

The backslash readily comes into my mind, and then all the line terminators.

 

[Denis McMahon]

The jquery script

See, that's your problem right there.

Rgds

Denis McMahon

 

[SpreadTooThin]

This would be much easier to analyze if the URL of an online version had
been included.



This sounds like a complicated and risky way of doing something fairly
simple. Anyway, your problem, in the current approach, is basically a
JavaScript problem, not HTML


Or maybe executes code injected by the intruder, through the huge
security hole that you have built.


The backslash readily comes into my mind, and then all the line terminators.

Right it's like sanatizing data base inputs.... So is there a sanatize
method?