in my jsp page, i hav the following javascript code
where it will set the form txtfield value

function fnRandom(var1) {
document.frm.txt1.value = var1;
}



in my java code,
i retrieve record from db which contain htmlentities.
then i suppose to printout to html like this

out.print("<a href=\"javascript:fnRandom("DB_INPUT_STR");\">runJS</a>");
-----
my problem is
when my DB_INPUT_STR contain single quote/double quote or other htmlentities, it will break my javascript.

anyidea?

From the java code itself, I think you have to either filter it out if those entities doesn't affect anything

yeah filter out. but hav to get it back when the value goes into the textfield. else it looks weird.

look my code, the error occur when i insert the double quote.
and if double quote not exist, it runs fine.
i manage to escape the single code but not double quote.



This post has been edited by giasens: Oct 27 2006, 03:57 PM

This was the same question i posted up last time in here. My only way is to try to avoid any double quotes in that area.

uhm. that's user input.
ok. i use escape & unescape,
it works in my jsp page,
but not in normal html such as this =.=;



This post has been edited by giasens: Oct 27 2006, 05:18 PM