In javascript replace single quote from string generated using serverside function

Question

In my Asp.Net site I have third party library in C# which has Method "LocalizeString" to generate local translation for text for controls.

var lblFriendName = '<%=LocalizeString("lblFriendName")%>';

This is causing issue for some string. In this case function returns string : Friend's name Where single quote is creating issue.

I cant modify server side code. So is there anyway to make this code line working in JavaScript ?

Answer 1

Use the HttpUtility.JavaScriptStringEncode method. This will escape any kinds of special JS characters for you. You should ALWAYS use this method when you want to output a string into JS, you can even have security issues with it! Eg. if the string is x'; alert('pwn!'); 'y x'; alert('pwn!'); 'y x'; alert('pwn!'); 'y , you will output this to your browser:

var lblFriendName = 'x'; alert('pwn!'); 'y';