如何获取ASP.net变量的值到JavaScript文本框中

Question

I'm writing some Javascript code for an ASP.net page.

I have the string "foo" assigned to a string variable myString .

I would like to assign the value of myString to a JavaScript variable, so I write in my ASP.net code:

<script type='txt/javascript' language='javascript'>
    var stringFromDotNet = '<%=myString%>';
</script>

This works fine as long as myString does not contain quotation marks or line-breaks, but as as soon as I try to assign something with quotation marks or line-breaks, all hell breaks loose and my code doesn't work. As a matter of fact, I can see that this code is vulnerable to all sort of injection attacks.

So... What can I do get the value of myString assigned to a variable in JavaScript?

Update : I've tried creating a page with just an ASP:Hidden field. It looks like the values inside are html encoded.

Answer 1

You could use JavaScriptSerializer and that's guaranteed to be safe against XSS:

<script type="text/javascript">
    var stringFromDotNet = <%= new JavaScriptSerializer().Serialize(myString) %>;
</script>

This approach also allows you to pass complex objects and not just plain strings:

<script type="text/javascript">
    var complexObjectFromDotNet = <%= new JavaScriptSerializer().Serialize(new { id = 123, name = "foo\"' <bar>" }) %>;
    alert(complexObjectFromDotNet.name);
</script>

Answer 2

I think this may be the answer are looking for: http://www.velocityreviews.com/forums/t70655-escape-function-in-asp-net.html#edit352659 . Basically, encode the value on the server side and unencode it with JavaScript:

var stringFromDotNet = decodeURI(<%=Server.URLEncode(myString)%>);

This will ensure that quotes and other dangerous characters won't break your script, or open up attack vectors.

Answer 3

You could either assign the js variable using double quotes like so

var stringFromDotNet = "<%=myString%>";

Or you could escape the single quotes and replace line breaks with literal "\\r\\n" in your string in the server side.