为什么这个字符串不会逃脱？

Question

usI have some html with an onSubmit:

<form id="login_box" onSubmit="alert('{{=T('Thank you for contacting us! We have received your email and will contact you shortly.')}}'); this.submit(); this.reset(); return false;">

The problem is that no matter what I do it won't escape the nested quotes. I've tried:

<form id="login_box" onSubmit="alert('{{=T(\'Thank you for contacting us! We have received your email and will contact you shortly.\')}}'); this.submit(); this.reset(); return false;">

<form id="login_box" onSubmit="alert(\"{{=T('Thank you for contacting us! We have received your email and will contact you shortly.')}}\"); this.submit(); this.reset(); return false;">

<form id="login_box" onSubmit=\"alert(\\"{{=T('Thank you for contacting us! We have received your email and will contact you shortly.')}}\\"); this.submit(); this.reset(); return false;\">

And any other combo I can think of even if I know it won't work. Nothing I try is escaping the nested quotes.

Answer 1

I think you are using twig or any similar template system in python.

If you want to translate {{=T('message to translate')}} , just put that string into a custom attr.

Example:

<form id="login_box" msg="{{=T('Thank you for contacting us! We have received your email and will contact you shortly.')}}" onSubmit="alert(this.getAttribute('msg')); this.submit(); this.reset(); return false;">

the example

:)

Answer 2

Assuming this is in a web2py template, your original code:

onSubmit="alert('{{=T('Thank you for contacting us! We have received your email and will contact you shortly.')}}'); this.submit(); this.reset(); return false;"

generates the following HTML:

onSubmit="alert('Thank you for contacting us! We have received your email and will contact you shortly.'); this.submit(); this.reset(); return false;"

which as far as I can tell, works fine in the browser. However, if you want to escape those single quotes inside the alert, you can do:

onSubmit="alert({{="'%s'" % T('Thank you for contacting us! We have received your email and will contact you shortly.')}}); this.submit(); this.reset(); return false;"

which will generate the following HTML:

onSubmit="alert('Thank you for contacting us! We have received your email and will contact you shortly.'); this.submit(); this.reset(); return false;"

which should also work in the browser.

Everything inside the {{ }} delimiters is Python code and will be executed on the server and escaped before writing into the response. Everything outside the {{ }} delimiters will be included in the response as is (ie, no escaping done by web2py). In your original code, the single quotes in the alert are outside the web2py template delimiters, so they are not escaped by web2py and simply delivered as is. This is explained further in this section of the web2py book.

Answer 3

In HTML attributes, some characters ( " and & ) have to be encoded as HTML entities. In javascript strings, the string delimiter (eg ' ), has to be escaped using a backslash. This means that your first one should work.

<form id="login_box" onSubmit="alert('{{=T(\'Thank you for contacting us! We have received your email and will contact you shortly.\')}}'); this.submit(); this.reset(); return false;">

This should alert {{=T('Thank you for contacting us! We have received your email and will contact you shortly.')}} when you click it. Assuming this is what you want?

Edit:

{{=T('Thank you for contacting us! We have received your email and will contact you shortly.')}}

will return a string, so

<form id="login_box" onSubmit="alert('{{=T('Thank you for contacting us! We have received your email and will contact you shortly.')}}'); this.submit(); this.reset(); return false;">

will become

<form id="login_box" onSubmit="alert('Thank you for contacting us! We have received your email and will contact you shortly.'); this.submit(); this.reset(); return false;">

in rendered HTML. This is correct. However, you need to escape any backslashes, then html entity encode the output of the T function (in that order).

Answer 4

对返回的值进行HTML编码，然后将其编码为JSON。