0
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<title>Insert title here</title>
<script type="text/javascript">
var  ts='';
function test(value1)
{
// this works when the value1 is a number only but if value1 is a string is does not work
    var optionsVal = ' ';   
    optionsVal= '<input type="button" onclick="postRun('+value1+')" value="test" /> ';
    document.getElementById('test').innerHTML = optionsVal;
}
function postRun(km)
{   
alert(km);
}

</script>
</head>
<body>
<%
String ss="Click Me";
%>
<input type="button" onclick="test('<%=ss%>')" value="Click me" />

<div id="test"></div>

</body>
</html>
0

1 Answer 1

1

Yes, this is because your embedded code is not escaped in the output. Use JSON:

optionsVal= '<input type="button" onclick=\'postRun('
    + JSON.stringify(value1) 
    + ')\' value="test" />';
Sign up to request clarification or add additional context in comments.

1 Comment

Be sure to make JSON available for older browsers with the json2 library.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.