Escaping JavaScript Strings in Python

Question

I have a Python script that builds some JavaScript to send down to the browser in a JSON envelope. I'd like to escape the JavaScript strings and delimit them with single quotes. I can't use json.dumps because it uses double quotes as delimiters like the JSON spec requires.

Is there a JavaScript String escape method in Python?

Example

def logIt(self, str):
    #todo: need to escape str here
    cmd = "console.log('%(text)s');" % { 'text': str}
    json.dumps({ "script": cmd })

So logIt('example text') should return something like this:

{
  "script": "console.log('example text');"
}

It seems to me that your code returns exactly what you need… — kirelagin
– kirelagin, Commented Jun 14, 2013 at 23:34
Oh, yeah, I see now. This probably should've been mentioned in the questions… — kirelagin
– kirelagin, Commented Jun 14, 2013 at 23:37
I care because a single quote is 1/4 the size of \\\" and I have a lot to send over the wire. — Lance Fisher
– Lance Fisher, Commented Jun 15, 2013 at 4:00

Eric · Accepted Answer · 2015-02-16 16:23:16Z

12

json.dumps is that escaping function - it takes any value, and makes it a valid javascript literal.

def logIt(self, str):
    cmd = "console.log({0});".format(json.dumps(str))
    json.dumps({ "script": cmd })

Producing:

>>> print logIt('example text')
{ "script": "console.log(\"example text\");" }
>>> print logIt('example "quoted" text')
{ "script": "console.log(\"example \\\"quoted\\\" text\");" }

Or:

import string
import json
import functools

quote_swap = functools.partial(
    string.translate, table=string.maketrans('\'"', '"\'')
)

def encode_single_quoted_js_string(s):
    return quote_swap(json.dumps(quote_swap(s)))

edited Feb 16, 2015 at 16:23

answered Jun 14, 2013 at 23:33

Eric

98.1k54 gold badges257 silver badges389 bronze badges

Sign up to request clarification or add additional context in comments.

6 Comments

Lance Fisher Over a year ago

Yeah, I know about json.dumps, but I want to avoid having \\\" for quotes that can be just '

Eric Over a year ago

@LanceFisher: But you can't avoid the \\\" here - the original text contained a ". I assume you're referring to the \"?

Lance Fisher Over a year ago

You're right, in this example it is the \". json.dumps that puts double quotes around it. Basically, I want a json.dumps() that outputs single quotes instead.

Taha Jahangir Over a year ago

json.dumps would be a security risk. (If the script is inside a <script> tag in html), json.dumps('</script>') returns "</script>". See owasp.org/index.php/… for right escaping

Eric Over a year ago

@TahaJahangir: That's only an issue if you use it in a context like print '<script>var myData = ' + json.dumps(...) + '; ... </script>'. If the json isn't directly injected into the page, as the OP is describing in this quesion, it's fine.

|

Collectives™ on Stack Overflow

Escaping JavaScript Strings in Python

1 Answer 1

6 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

6 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related