Question

How can I make this more secure and safe:

• Strip unsafe characters from title
• Prevent undefined errors

Code so far:

// Open HREF in popup window
$('.external').bind('click', function () {
    var url = $(this).attr("href");
    var title = ($(this).attr("data-popup-title")) ? $(this).attr("data-popup-title") : $(this).attr("title");
    var image = $(this).attr("data-popup-image");
    var width = ($(this).attr("data-popup-width")) ? $(this).attr("data-popup-width") : '626';
    var height = ($(this).attr("data-popup-height")) ? $(this).attr("data-popup-height") : '436';
    window.open('http://www.facebook.com/sharer.php?s=100&p[title]=' + title + '&p[url]=' + url + '&&p[images][0]=' + image, 'sharer', 'toolbar=0,status=0,width='+width+',height='+height);
    return false;
});

Also is it best practice to return false or use the preventDefault()?

Answer 1

It’s not about best-practices, preventDefault() and return false do different things. Returning false prevents the event from bubbling up through other handlers, while preventDefault simply prevents the default “click” action (typically following the href of the link) from occurring after all other event handlers have run.