在JavaScript中正确处理mongodb时转义单引号

Question

To use a tts method in my javascript code I wrote this code:

i(class="btn-left-margin fa fa-volume-down fa-2x speak-task", onclick=`responsiveVoice.speak(${word.rq}, "French Female");return false;`)

and the French sentence is saved to mongodb as "...jusqu'à...", that is it has a single quote.

This breaks the code obviously and I get:

SyntaxError: missing ) after argument list

How to properly escape to prevent this and similar cases to happen? I remember "validate input, escape output" but I don't know how!

If I remove the single quote and have it as "...jusqu à...", it works fine. I just found out that I don't know how properly escape all javascript related characters before saving to mongodb.
By reading forum here , I solved my case with this improvement:

onclick=`let x="${word.ea}".replace(/['"]+/g, ' ');speakEn(x)`

but I think there must be some best practice for escaping the code in JS that I don't know, which will escape out all special characters when publishing text from mongodb (like "<" and ">", etc.). I first thought it could be escape() method, but it happens not to be the one and even deprecated.

Answer 1

这段代码解决了我的问题：

onclick=`let x="${word.ea}".replace(/['"]+/g, ' ');speakEn(x)`