Changeset 6892

Timestamp:

12/04/07 15:08:29 (9 months ago)

Author:

jacob

Message:

Fixed #4131: added an "escapejs" filter for use in JavaScript? strings, and updated the documentation on addslashes to point to the new ticket. Featuring contributions from Ned Batchelder, Jeremy Dunck, and Andy Durdin.

Files:

• django/trunk/django/template/defaultfilters.py (modified) (2 diffs)
• django/trunk/docs/templates.txt (modified) (2 diffs)
• django/trunk/tests/regressiontests/defaultfilters/tests.py (modified) (1 diff)

django/trunk/django/template/defaultfilters.py

@@ -44 +44 @@
-
-def addslashes(value):
-
+
+
+
+
+
-    return value.replace('\\', '\\\\').replace('"', '\\"').replace("'", "\\'")
-addslashes.is_safe = True
@@ -54 +58 @@
-capfirst.is_safe=True
-capfirst = stringfilter(capfirst)
+
+_js_escapes = (
+    ('\\', '\\\\'),
+    ('"', '\\"'),
+    ("'", "\\'"),
+    ('\n', '\\n'),
+    ('\r', '\\r'),
+    ('\b', '\\b'),
+    ('\f', '\\f'),
+    ('\t', '\\t'),
+    ('\v', '\\v'),
+    ('</', '<\\/'),
+)
+def escapejs(value):
+    """Backslash-escapes characters for use in JavaScript strings."""
+    for bad, good in _js_escapes:
+        value = value.replace(bad, good)
+    return value
+escapejs = stringfilter(escapejs)
-
-def fix_ampersands(value):

django/trunk/docs/templates.txt

@@ -1228 +1228 @@
-~~~~~~~~~~
-
-
-
+
+
+
+
-
-capfirst
@@ -1302 +1304 @@
-it is safe to use this function even in auto-escaping environments. If you want
-multiple escaping passes to be applied, use the ``force_escape`` filter.
+
+escapejs
+~~~~~~~~
+
+**New in Django development version**
+
+Escapes characters for use in JavaScript strings. This does *not* make the
+string safe for use in HTML, but does protect you from syntax errors when using
+templates to generate JavaScript/JSON.
-
-filesizeformat

django/trunk/tests/regressiontests/defaultfilters/tests.py

@@ -50 +50 @@
-u'Hello world'
-
+>>> escapejs(u'"double quotes" and \'single quotes\'')
+u'\\"double quotes\\" and \\\'single quotes\\\''
+
+>>> escapejs(ur'\ : backslashes, too')
+u'\\\\ : backslashes, too'
+
+>>> escapejs(u'and lots of whitespace: \r\n\t\v\f\b')
+u'and lots of whitespace: \\r\\n\\t\\v\\f\\b'
+
+>>> escapejs(ur'<script>and this</script>')
+u'<script>and this<\\/script>'
+
->>> fix_ampersands(u'Jack & Jill & Jeroboam')
-u'Jack &amp; Jill &amp; Jeroboam'