Question

I made a webpage that needs javascript. More specifically if anyone has heard of it, I am using an Ajax-Solr API to make a good user interface for an Apache Solr/Lucene Search Engine. For some of the results that come up (which are webpages that have been crawled), javascript is embedded on some of the webpages, and that is messing up part of my subsequent html/javascript. Help me out. Here is some of my code:

AjaxSolr.theme.prototype.snippet = function(doc) {
    var output = '' + doc.id;
    if (doc.text.length > 300) {
        output += doc.text.substring(0, 300);
        output += '<span style="display:none;">' + doc.text.substring(300);
        output += '</span> <br id="aftsnippet"/><a href="#" class="more"><button id = "expand' + doc.id + '">Expand/Contract</button></a>';
    } else {
        output += doc.text + '<br/>';
    }
    output+='<a id="goToSite"><button>Go to Site</button></a><a href="pages/sitedetails.html?id=' + doc.id + '" target="_blank"><button id = "sitedetailsbutton' + doc.id + '">Site Details</button></a>';
    return output;
};

I don’t know if that helps, but pretty much what happens is that doc.text might contain some random javascript from a javascript file online, and then that causes the buttons from

<button>Go to Site</button></a><a href="pages/sitedetails.html?id=' + doc.id + '" target="_blank"><button id = "sitedetailsbutton' + doc.id + '">Site Details</button></a>';

to not show up. What could I do to fix this?

Answer 1

You need to HTML-encode the JavaScript. You can do that with the following.

function htmlEncode(s) {
    return s.replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;');
}

Also, you can replace newline characters with <br />, as appropriate:

function htmlEncode(s) {
    return s.replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/\n/g,'<br />');
}