xslt, javascript and unescaped html entities

Question

i have a tiny little problem with xslt, js and html entities, eg. within a template:

<script type="text/javascript">
    <xsl:value-of select="/some/node"/>
    for (var i = 0; i &lt; 5; i++) {
        //            ^^^ js error
    }
</script>

<script type="text/javascript">
    <xsl:value-of select="/some/node"/>
    for (var i = 0; i < 5; i++) {
        //            ^ xslt error
    }
</script>

<script type="text/javascript">
    <xsl:value-of select="/some/node"/>
    // <![CDATA[
    for (var i = 0; i < 5; i++) {
        //            ^ becomes &lt;
    }
    // ]]>
</script>


<script type="text/javascript">
    <xsl:value-of select="/some/node"/>
    for (var i = 0; i <xsl:value-of disable-output-escaping="yes" select="string('&lt;')"/> 5; i++) {
        // works of course
    }
</script>

does anyone have an idea where my problem could come from? i always thought the xslt processor would leave the content of a <script/> element unescaped when using the html output method ...

i run libxslt2 version 1.1.24 on OSX which was installed using macportsports ...

(answer deleted as no longer relevant)

annakata
– annakata

2009-01-12 10:47:51 +00:00
Commented Jan 12, 2009 at 10:47 — annakata
– annakata, Commented Jan 12, 2009 at 10:47

Matthew Murdoch · Accepted Answer · 2010-02-26 22:06:06Z

14

ok. long story, short answer:

it seems that with some libxslt versions the xslt processor leaves the content of a <script/> element unescaped when using the html output method, with others not ... therefore the following is recommended:

<script type="text/javascript">
    <xsl:value-of select="/some/node"/>
    <xsl:text disable-output-escaping="yes">
        // ^ does the trick ...
        for (var i = 0; i < 5; i++) {
            //            ^ works
        }
    </xsl:text>
</script>

edited Feb 26, 2010 at 22:06

Matthew Murdoch

31.6k32 gold badges99 silver badges127 bronze badges

answered Jan 12, 2009 at 13:54

Pierre Spring

10.7k13 gold badges52 silver badges44 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Marcos Buarque Over a year ago

HEY! You saved my life. No, at least a couple of hours! Thanks.

danjah Over a year ago

Gidday there, this Question's a bit old now but if you get this, perhaps you can help with my Q? stackoverflow.com/questions/6411376/… Its the same problem, but your solution works on my localhost, but not my hosted server. They appear to have the same configuration :/

basZero Over a year ago

This does not work in my case. I get the XSLT error The content of elements must consist of well-formed character data or markup. and it points to the line with the <

bobince · Accepted Answer · 2009-01-12 10:55:01Z

5

i always thought the xslt processor would leave the content of a script element unescaped when using the html output method

You are correct: http://www.w3.org/TR/xslt#section-HTML-Output-Method

The html output method should not perform escaping for the content of the script and style elements.
For example, a literal result element written in the stylesheet as
    <script>if (a &lt; b) foo()</script>
or
    <script><![CDATA[if (a < b) foo()]]></script>
should be output as
    <script>if (a < b) foo()</script>

If your XSLT processor is doing otherwise, it's a bug.

However, in any case it's a good idea to avoid '<' and '&' in embedded scripts, and an even better idea to kick all the code out into a linked .js file.

answered Jan 12, 2009 at 10:55

bobince

538k111 gold badges675 silver badges846 bronze badges

2 Comments

annakata Over a year ago

If XSLT is generating the variable JS script, a linked js file isn't always a possibility and avoiding < and & isn't going to be realistic

Pierre Spring Over a year ago

looks like a bug then ... i'll try to narrow it down the best i can an submit the bug report ... cheerz for your answer ...

Olivier Payen · Accepted Answer · 2009-01-12 10:25:13Z

1

Try removing the double slash before the CDATA of your third solution

answered Jan 12, 2009 at 10:25

Olivier Payen

15.3k7 gold badges43 silver badges70 bronze badges

Comments

Jason Plank · Accepted Answer · 2011-11-14 15:02:06Z

1

The CDATA blocks should have worked; they always have for me. What's your disable-output-escaping value?

UPDATE: Using Xalan, with disable-output-escaping on its default, which I'm pretty sure is no, I have the following in my working XSL files:

No CDATA block:

for (var i = 0; i `&lt;` foo.length; i++) {
…
}

CDATA block:

<![CDATA[

for (var i = 0; i < foo.length; i++) { … }

]]>

edited Nov 14, 2011 at 15:02

Jason Plank

2,3325 gold badges32 silver badges40 bronze badges

answered Jan 12, 2009 at 10:21

Hank Gay

72.4k36 gold badges164 silver badges224 bronze badges

1 Comment

Pierre Spring Over a year ago

do you mean using the following: <xsl:value-of disable-output-escaping="yes" select="string('&')"/> works, but this isn't how is should work, right?

Timofey Stolbov · Accepted Answer · 2012-12-27 11:02:30Z

0

If the xsl:output method is html, the CDATA section would work. If the xsl:output method is xml, the < and > signs would still be converted.

To get around this problem, you may define the script element to not behave this way using the xsl:output element. you can also force the method of the output using xml or html

<xsl:output method="xml" cdata-section-elements="script" />
...
<script type="text/javascript" language="javascript">
<![CDATA[
  for (var i = 0; i &lt; foo.length; i++) { … }
]]>
</script>

edited Dec 27, 2012 at 11:02

Timofey Stolbov

4,6813 gold badges42 silver badges46 bronze badges

answered Mar 18, 2010 at 12:32

Laurent Picquet

1

1 Comment

basZero Over a year ago

This does not work in my case, what I get in the output is &lt;, and my output type is html

Collectives™ on Stack Overflow

xslt, javascript and unescaped html entities

5 Answers 5

3 Comments

2 Comments

Comments

1 Comment

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

5 Answers 5

3 Comments

2 Comments

Comments

1 Comment

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related