Question

I have this HTML escaping method:

public static String stringToHTMLString(String string) {
    StringBuffer sb = new StringBuffer(string.length());
    // true if last char was blank
    boolean lastWasBlankChar = false;
    int len = string.length();
    char c;

    for (int i = 0; i < len; i++)
        {
        c = string.charAt(i);
        if (c == ' ') {
            // blank gets extra work,
            // this solves the problem you get if you replace all
            // blanks with &nbsp;, if you do that you loss 
            // word breaking
            if (lastWasBlankChar) { // NOT going into this loop
                lastWasBlankChar = false;
                sb.append("&nbsp;");
                }
            else {
                lastWasBlankChar = true;
                sb.append(' ');
                }
            }
        else {
            lastWasBlankChar = false;
            //
            // HTML Special Chars
            if (c == '"')
                sb.append("&quot;");
            else if (c == '&')
                sb.append("&amp;");
            else if (c == '<')
                sb.append("&lt;");
            else if (c == '>')
                sb.append("&gt;");
            else if (c == '\n')
                // Handle Newline
                sb.append("&lt;br/&gt;");
            else {
                int ci = 0xffff & c;
                if (ci < 160 )
                    // nothing special only 7 Bit
                    sb.append(c);
                else {
                    // Not 7 Bit use the unicode system
                    sb.append("&#");
                    sb.append(new Integer(ci).toString());
                    sb.append(';');
                    }
                }
            }
        }
    return sb.toString();
}

When I pass it with the string “bo y”, it returns “bo y”. When I change the input string to “bo>y”, it correctly escapes the string. Any idea why the space escaping isn’t working?

Thanks.

Answer 1

Works fine when I run it, I get:

stringToHTMLString("This is  a   multi-space      test")
This is  a   multi-space      test

Hmm, now that I think about it, were you expecting the first space to be escaped? Follow the logic, it starts with a space first and then a non-breaking space alternately, since it’s initially false.

This doesn’t answer your actual question, but a better way of doing what you’re trying to do is to use CSS’s white-space: pre-wrap; on the element… if you can get away with supporting IE8+. Otherwise, for older IE, you have to use

white-space: normal !important;
white-space: pre-wrap;
word-wrap: break-word;

Your definition of 7-bit safe characters is also… interesting. Might be better to use UTF-8 unless you have to support Windows 98, rather than manually escaping unusual characters, and probably drop non-formatting control codes entirely.