Question

ScriptManager.RegisterStartupScript(page, 
    page.GetType(),
    "KEY",
    "updateDockTitle('" + ClientID + "', '" + string.Format(format, ChartName, "No Data To Display") + "');".Replace("-", "\\-"),
    true);

ChartName has the ability to contain special characters (e.g. Someone’s Chart). If allowed as is this causes an error the code hits the ' when it was not expecting it.

What’s the proper way to handle this scenario? Do I need to know all characters that could cause issues and replace them with escaped out versions?

Answer 1

I’ve found this comprehensive solution handy:

private static readonly Regex scriptTagRegex = new Regex(
    "script", RegexOptions.IgnoreCase | RegexOptions.Multiline);

/// <summary>
///     Processes the provided string, creating a quoted JavaScript string literal.
/// </summary>
/// <param name="str">The string to process</param>
/// <returns>A string containing a quoted JavaScript string literal</returns>
public static string JavaScriptStringLiteral(string str)
{
    var sb = new StringBuilder();
    sb.Append("\"");
    foreach (char c in str)
    {
        switch (c)
        {
            case '\"':
                sb.Append("\\\"");
                break;
            case '\\':
                sb.Append("\\\\");
                break;
            case '\b':
                sb.Append("\\b");
                break;
            case '\f':
                sb.Append("\\f");
                break;
            case '\n':
                sb.Append("\\n");
                break;
            case '\r':
                sb.Append("\\r");
                break;
            case '\t':
                sb.Append("\\t");
                break;
            default:
                int i = (int)c;
                if (i < 32 || i > 127)
                {
                    sb.AppendFormat("\\u{0:X04}", i);
                }
                else
                {
                    sb.Append(c);
                }
                break;
        }
    }
    sb.Append("\"");

    // If a Javascript tag contains "</script>", then it terminates a
    // script block.  Start by replacing each 's'/'S' with an escape
    // sequence so it doesn't trigger this.
    return scriptTagRegex.Replace(
        sb.ToString(),
        m => (m.Value[0] == 's' ? "\\u0073" : "\\u0053") + m.Value.Substring(1));
}

It should replace all invalid JS characters and also make sure there’s no breakage if your script is inline (which it would be in your case). Note that it already generates the quotes for the string literal, so keep that in mind if you decide to use it.