Question

Do you ever escape single quotes in template toolkit for necessary javascript handlers? If so, how do you do it.

[% SET s = "A'B'C" %]

<a href="/abc.html" onclick="popup('[% s | html_entity %]')">ABC</a>

html_entity obviously doesn’t work because it only handles the double quote. So how do you do it?

Answer 1

I don’t use the inlined event handlers — for the same reason I refuse to use the style attribute for css. Jquery just makes it to easy to do class="foo" on the html and $('.foo').click( function () {} ), in an external .js file.

But, for the purpose of doing my best to answer this question, check out these docs on Template::Filter for the ones in core.

It seems as if you could do [% s | replace( "'", "\\'" ) %], to escape single quotes. Or you could probably write a more complex sanitizing javascript parser that permits only function calls, and make your own Template::Filter