diff options
Diffstat (limited to 'docs/content/en/functions/safe/JSStr.md')
-rw-r--r-- | docs/content/en/functions/safe/JSStr.md | 61 |
1 files changed, 61 insertions, 0 deletions
diff --git a/docs/content/en/functions/safe/JSStr.md b/docs/content/en/functions/safe/JSStr.md new file mode 100644 index 000000000..790de3a73 --- /dev/null +++ b/docs/content/en/functions/safe/JSStr.md @@ -0,0 +1,61 @@ +--- +title: safe.JSStr +linkTitle: safeJSStr +description: Declares the provided string as a known safe JavaScript string. +categories: [functions] +keywords: [] +menu: + docs: + parent: functions +function: + aliases: [safeJSStr] + returnType: template.JSStr + signatures: [safe.JSStr INPUT] +relatedFunctions: + - safe.CSS + - safe.HTML + - safe.HTMLAttr + - safe.JS + - safe.JSStr + - safe.URL +aliases: [/functions/safejsstr] +--- + +Encapsulates a sequence of characters meant to be embedded between quotes in a JavaScript expression. Use of this type presents a security risk: the encapsulated content should come from a trusted source, as it will be included verbatim in the template output. + +Without declaring a variable to be a safe JavaScript string: + +```go-html-template +{{ $title := "Lilo & Stitch" }} +<script> + const a = "Title: " + {{ $title }}; +</script> +``` + +Rendered: + + +```html +<script> + const a = "Title: " + "Lilo \u0026 Stitch"; +</script> +``` + +To avoid escaping by Go's [html/template] package: + +```go-html-template +{{ $title := "Lilo & Stitch" }} +<script> + const a = "Title: " + {{ $title | safeJSStr }}; +</script> +``` + +Rendered: + +```html +<script> + const a = "Title: " + "Lilo & Stitch"; +</script> +``` + +[html/template]: https://pkg.go.dev/html/template |