summaryrefslogtreecommitdiffstats
path: root/content/en/functions/safe/JSStr.md
diff options
context:
space:
mode:
Diffstat (limited to 'content/en/functions/safe/JSStr.md')
-rw-r--r--content/en/functions/safe/JSStr.md55
1 files changed, 55 insertions, 0 deletions
diff --git a/content/en/functions/safe/JSStr.md b/content/en/functions/safe/JSStr.md
new file mode 100644
index 000000000..36d2b36fa
--- /dev/null
+++ b/content/en/functions/safe/JSStr.md
@@ -0,0 +1,55 @@
+---
+title: safe.JSStr
+description: Declares the given string as a safe JavaScript string.
+categories: []
+keywords: []
+action:
+ aliases: [safeJSStr]
+ related:
+ - functions/safe/CSS
+ - functions/safe/HTML
+ - functions/safe/HTMLAttr
+ - functions/safe/JS
+ - functions/safe/URL
+ returnType: template.JSStr
+ signatures: [safe.JSStr INPUT]
+aliases: [/functions/safejsstr]
+---
+
+Encapsulates a sequence of characters meant to be embedded between quotes in a JavaScript expression. Use of this type presents a security risk: the encapsulated content should come from a trusted source, as it will be included verbatim in the template output.
+
+Without declaring a variable to be a safe JavaScript string:
+
+```go-html-template
+{{ $title := "Lilo & Stitch" }}
+<script>
+ const a = "Title: " + {{ $title }};
+</script>
+```
+
+Rendered:
+
+```html
+<script>
+ const a = "Title: " + "Lilo \u0026 Stitch";
+</script>
+```
+
+To avoid escaping by Go's [html/template] package:
+
+```go-html-template
+{{ $title := "Lilo & Stitch" }}
+<script>
+ const a = "Title: " + {{ $title | safeJSStr }};
+</script>
+```
+
+Rendered:
+
+```html
+<script>
+ const a = "Title: " + "Lilo & Stitch";
+</script>
+```
+
+[html/template]: https://pkg.go.dev/html/template