转义html / javascript：使用jQuery将db字段的内容附加到DOM中

Question

I want to do the following within rails. In a textfield of my db, there is the following html / javascript:

<script type="text/javascript">
  document.write('<div id="test"></div>');
</script>

I want to append the contents of this field into the head-tag of the DOM, so the inserted js will be executed.

In my rails erb-view, I have the following:

<script type="text/javascript">
  var code = "<%= @ticket.code %>"; // Content of codesnippet above
  $('head').append(code);
</script>

However I get some the following rendered output of the view:

var code = "<script type="text/javascript">
  document.write('<div id="test"></div>');
</script>"; 

Error message: unterminated string literal

I tried to gsub linebreaks and other ways of escaping, but I've got no clue, what actually is the best way to escape it. How can I get it correclty escaped and inserted into the DOM?

Thanks for your help!

Answer 1

I believe rails 3 comes with JQuery so why not just use:

$(document).onload(function()
{ 
    document.write('<div id="test"></div>');
});

and I believe on var code you should do the following:

var code = "<%= escape_javascript(@ticket.code.html_safe) %>"