NAME

SYNOPSIS

  use JavaScript::Value::Escape;

  my $escaped = javascript_value_escape(q!&foo"bar'</script>!);
  # $escaped is "\u0026foo\u0022bar\u0027\u003c\/script\u003e"

  my $html_escaped = javascript_value_escape(Text::Xslate::Util::escape_html(q!&foo"bar'</script>!));

  print <<EOF;
  <script>
  var param = '$escaped';
  alert(param);

  document.write('$html_escaped');

  </script>
  EOF

DESCRIPTION

The escaping routine JavaScript::Value::Escape provides escapes for q!"!, q!'!, q!&!, q!=!, q!-!, q!+!, q!;!, q!<!, q!>!, q!/!, q!\! and control characters to JavaScript unicode entities like "\u0026".

EXPORT FUNCTION

javascript_value_escape($value :Str) :Str

Escape a string. The argument of this function must be a text string (a.k.a. UTF-8 flagged string, Perl's internal form).

This is exported by default.

js($value :Str) :Str

Alias to "javascript_value_escape()" for convenience.

This is exported by your request.

AUTHOR

THANKS TO

SEE ALSO

<http://blog.nomadscafe.jp/2010/11/htmlscript.html> - Wrote a module (JavaScript::Value::Escape) to escape data for HTML script sections (Japanese)

<https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet> - Preventing XSS (Cross Site Scripting) (English)

RFC4627 - The application/json Media Type for JSON

LICENSE