NAME

JavaScript::Value::Escape - Avoid JavaScript value XSS

SYNOPSIS

  use JavaScript::Value::Escape;

  my $escaped = javascript_value_escape(q!&foo"bar'</script>!);
  # $escaped is "\u0026foo\u0022bar\u0027\u003c\/script\u003e"

  my $html_escaped = javascript_value_escape(Text::Xslate::Util::escape_html(q!&foo"bar'</script>!));

  print <<EOF;
  <script>
  var param = '$escaped';
  alert(param);

  document.write('$html_escaped');

  </script>
  EOF

DESCRIPTION

To avoid XSS with JavaScript Value, JavaScript::Value::Escape escapes q!"!, q!'!, q!&!, q!<!, q!>!, q!/!, q!\!, qq!\r! and qq!\n! to JavaScript unicode characters like "\u5bae".

EXPORT FUNCTION

javascript_value_escape($value:Str); Str

Escape a string.

AUTHOR

Masahiro Nagano <kazeburo {at} gmail.com>

SEE ALSO

LICENSE

This library is free software; you can redistribute it and/or modify it under the same terms as Perl itself.