Question

<document.write('<SCR'+'IPT TYPE='text/javascript' SRC=''+'http'+(window.location.protocol.indexOf('https:')==0?'s':'')+'://'+gDomain+'/'+gDcsId+'/wtid.js'+''><\/SCR'+'IPT>'); 

I need to escape the string above in order to add the whole thing to a StringBuilder but so far I must be missing something because string termination is not correct…

Answer 1

string x = @'<document.write(''<SCR''+''IPT TYPE='''text/javascript' SRC='''+''http''+(window.location.protocol.indexOf('https:')==0?'s':'')+''://''+gDomain+''/''+gDcsId+''/wtid.js''+'''><\/SCR''+''IPT>'');'; 

The @ prefix makes escaping simpler. You just have to turn each ‘ into ”.

You will find your program much easier to maintain if you store the JavaScript in an external file. I assume you’re using StringBuilder so you can mix bits of constant script with a few dynamic values? You could write it in a file but put escapes like this for the dynamic values:

var fromCSharp = {0}; 

Then at runtime, load the JS file and give it to string.Format as the format string, along with values to replace each occurrence of {0}, {1}, etc. You only need to load the format string from the file once and keep it cached.

Also if the values you are inserting into the JavaScript are themselves string literals, you will need to escape them according to the syntax of JavaScript.