为什么这根绳子不会逃脱

Why won't this string escape?

本文关键字：逃脱 为什么      更新时间：2023-09-26

us我有一些带有onSubmit的html：

<form id="login_box" onSubmit="alert('{{=T('Thank you for contacting us! We have received your email and will contact you shortly.')}}'); this.submit(); this.reset(); return false;">

问题是，无论我做什么，它都不会逃脱嵌套引号。我试过：

<form id="login_box" onSubmit="alert('{{=T(''Thank you for contacting us! We have received your email and will contact you shortly.'')}}'); this.submit(); this.reset(); return false;">
<form id="login_box" onSubmit="alert('"{{=T('Thank you for contacting us! We have received your email and will contact you shortly.')}}'"); this.submit(); this.reset(); return false;">
<form id="login_box" onSubmit='"alert(''"{{=T('Thank you for contacting us! We have received your email and will contact you shortly.')}}''"); this.submit(); this.reset(); return false;'">

以及我能想到的任何其他组合，即使我知道它不起作用。我尝试的任何东西都没有转义嵌套引号。

我认为你在python中使用twig或任何类似的模板系统。

如果要翻译{{=T('message to translate')}}，只需将该字符串放入自定义 attr 中即可。

例：

<form id="login_box" msg="{{=T('Thank you for contacting us! We have received your email and will contact you shortly.')}}" onSubmit="alert(this.getAttribute('msg')); this.submit(); this.reset(); return false;">

示例

:)

假设这是在web2py模板中，您的原始代码：

onSubmit="alert('{{=T('Thank you for contacting us! We have received your email and will contact you shortly.')}}'); this.submit(); this.reset(); return false;"

生成以下 HTML：

onSubmit="alert('Thank you for contacting us! We have received your email and will contact you shortly.'); this.submit(); this.reset(); return false;"

据我所知，它在浏览器中工作正常。但是，如果要转义警报中的单引号，可以执行以下操作：

onSubmit="alert({{="'%s'" % T('Thank you for contacting us! We have received your email and will contact you shortly.')}}); this.submit(); this.reset(); return false;"

这将生成以下 HTML：

onSubmit="alert(&#x27;Thank you for contacting us! We have received your email and will contact you shortly.&#x27;); this.submit(); this.reset(); return false;"

这也应该在浏览器中工作。

{{ }}分隔符中的所有内容都是 Python 代码，将在服务器上执行并在写入响应之前进行转义。{{ }}分隔符之外的所有内容都将按原样包含在响应中（即，web2py 不会进行转义）。在原始代码中，警报中的单引号位于 web2py 模板分隔符之外，因此它们不会被 web2py 转义，而只是按原样传递。这在web2py书的这一部分中有进一步的解释。

对

返回的值进行HTML编码，然后将其编码为JSON。

在HTML属性中，一些字符（"和&）必须编码为HTML实体。在javascript字符串中，字符串分隔符（例如'）必须使用反斜杠进行转义。这意味着您的第一个应该可以工作。

<form id="login_box" onSubmit="alert('{{=T(''Thank you for contacting us! We have received your email and will contact you shortly.'')}}'); this.submit(); this.reset(); return false;">

当您单击它时，这应该会提醒{{=T('Thank you for contacting us! We have received your email and will contact you shortly.')}}。假设这是你想要的？

编辑：

{{=T('Thank you for contacting us! We have received your email and will contact you shortly.')}}

将返回一个字符串，因此

<form id="login_box" onSubmit="alert('{{=T('Thank you for contacting us! We have received your email and will contact you shortly.')}}'); this.submit(); this.reset(); return false;">

将成为

<form id="login_box" onSubmit="alert('Thank you for contacting us! We have received your email and will contact you shortly.'); this.submit(); this.reset(); return false;">

在呈现的 HTML 中。这是正确的。但是，您需要转义任何反斜杠，然后 html 实体对 T 函数的输出进行编码（按该顺序）。

相关文章：