.attr does not unescape and escape attribute values
See original GitHub issueWhen setting or getting the value of an attribute using .attr
, then those values should be escaped/unescaped otherwise invalide html is created when using $.html()
.
An example would be if you try to store JSON encoded data in an attribute:
$(elm).attr('data-test','{"key":"value"}');
Then the resulting html would be something like that:
<tag data-test="{"key":"value"}">
And if the element looks like this:
<tag data-test="{"key":"value"}">
Then $(elm).attr('data-test');
return {"key":"value"}
instead of {"key":"value"}
.
I have tested it with the version 0.22.0
Issue Analytics
- State:
- Created 7 years ago
- Comments:5 (1 by maintainers)
Top Results From Across the Web
Escaping of attribute values using jQuery.attr() - Stack Overflow
jQuery isn't escaping anything, in fact your string is literally set as the title. You can simply use: $("div").attr('title','foo\nbar').
Read more >Javascript – Escaping of attribute values using jQuery.attr() – iTecNote
Is there a way to not have jQuery escape the value? I tried using unescape() before .attr() , but it didn't work… Best...
Read more >Cross Site Scripting Prevention - OWASP Cheat Sheet Series
Ensuring that all variables go through validation and are then escaped or sanitized is known as perfect injection resistance. Any variable that does...
Read more >org.unbescape.html.HtmlEscape.escapeHtml4Xml java code ...
Level 1 means this method will only escape the five markup-significant characters: <, >, &, " and '. It is called XML-style in...
Read more >Escaping HTML Attributes - Laminas Documentation
Escaping data in HTML Attribute contexts is most often done incorrectly, if not overlooked completely by developers. Regular HTML escaping can be used...
Read more >Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start FreeTop Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Top GitHub Comments
Load the document using the
decodeEntities: false
option, then the actual characters are used instead of HTML entities:How would it be possible to correctly parse
the single quotes get replaced by double quotes which produces wrong output.