NAME

JavaScript::Value::Escape - Avoid JavaScript value XSS

SYNOPSIS

use JavaScript::Value::Escape;

my $escaped = javascript_value_escape(q!&foo"bar'</script>!);
# $escaped is "\u0026foo\u0022bar\u0027\u003c\/script\u003e"

my $html_escaped = javascript_value_escape(Text::Xslate::Util::escape_html(q!&foo"bar'</script>!));

print <<EOF;
<script>
var param = '$escaped';
alert(param);

document.write('$html_escaped');

</script>
EOF

DESCRIPTION

To avoid XSS with JavaScript Value, JavaScript::Value::Escape escapes q!"!, q!'!, q!&!, q!<!, q!>!, q!/!, q!\!, qq!\r! and qq!\n! to JavaScript unicode characters like "\u5bae".

EXPORT FUNCTION

javascript_value_escape($value:Str); Str

Escape a string.

AUTHOR

Masahiro Nagano <kazeburo {at} gmail.com>

SEE ALSO

LICENSE

This library is free software; you can redistribute it and/or modify it under the same terms as Perl itself.