Home/ Questions/Q 427001
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-12T19:32:08+00:00

I’m developing a facebook app right now all by my lonesome. I’m attempting to

  • 0

I’m developing a facebook app right now all by my lonesome. I’m attempting to make a javascript call on an onclick event. In this onclick event, I’m populating some arguments (from the server side in php) based on that item that is being linked. I’m inserting a little bit of JSON and some other stuff with funky characters.

Facebook expects all the attribute fields of an anchor to be strictly alphanumeric. No quotes, exclamation marks, anything other than 0-9a-Z_. So it barfs on the arguments I want to pass to my javascript function (such as JSON) when the user clicks that link.

So I thought, why don’t I use my templating system to just autogenerate the javascript? For each link I want to generate, I generate a unique javascript function (DoItX where X is a unique integer for this page). Then instead of trying to pass arguments to my javascript function via onclick, I will insert my arguments as local variables for DoX. On link “X” I just say onclick=”DoX()”.

So I did this and viola it works! (it also helps me avoid the quote escaping hell I was in earlier). But I feel icky.

My question is, am I nuts? Is there an easier way to do this? I understand the implications that somehow somebody was able to change my templated local variable, ie:

var local = {TEMPLATED FIELD};

into something with a semicolon, inserting arbitrary javascript to the client. (and I’m trying to write code to be paranoid of this).

When is it ok (is it ever ok) to generate javascript from the server? Anything I should look out for/best practices?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Depending on your application generating JavaScript in your templating language can save a lot of time but there are pitfalls to watch out for. The most serious one being that it gets really hard to test your JavaScript when you don’t have your full templating stack available.

    One other major pitfall is that it becomes tempting to try and ‘abstract’ JavaScript logic to some higher level classes. Usually this is a sign that you will be shaving yaks in your project. Keep JavaScript login in JavaScript.

    Judging from the little bit of information you have given it your solution seems sensible.

    • 0