Simon Willison's Weblog: escaping

Escaping regular expression characters in JavaScript (updated)

2010-07-04T18:23:00+00:00

Escaping regular expression characters in JavaScript (updated)

The JavaScript regular expression meta-character escaping code I posted back in 2006 has some serious flaws—I’ve just posted an update to the original post.

Tags: escaping, javascript, regular-expressions, recovered

Unicode code converter

2009-12-15T22:10:29+00:00

Unicode code converter

Fantastically useful tool to convert strings of characters in to every unicode and/or escaping syntax you can possibly imagine.

Via NYTimes Open Blog

Tags: escaping, tools, unicode

Reducing XSS by way of Automatic Context-Aware Escaping in Template Systems

2009-04-14T09:26:04+00:00

Reducing XSS by way of Automatic Context-Aware Escaping in Template Systems

The Google Online Security Blog reminds us that simply HTML-escaping everything isn’t enough—the type of escaping needed depends on the current markup context, for example variables inside JavaScript blocks should be escaped differently. Google’s open source Ctemplate library uses an HTML parser to keep track of the current context and apply the correct escaping function automatically.

Via taviso

Tags: ctemplate, django, escaping, google, html, open-source, security, xss

Escaping regular expression characters in JavaScript

2006-01-20T12:19:13+00:00

JavaScript's support for regular expressions is generally pretty good, but there is one notable omission: an escaping mechanism for literal strings. Say for example you need to create a regular expression that removes a specific string from the end of a string. If you know the string you want to remove when you write the script this is easy:

var newString = oldString.replace(/Remove from end$/, '');

But what if the string to be removed comes from a variable? You'll need to construct a regular expression from the variable, using the RegExp constructor function:

var re = new RegExp(stringToRemove + '$');
var newString = oldString.replace(re, '');

But what if the string you want to remove may contain regular expression metacharacters - characters like $ or . that affect the behaviour of the expression? Languages such as Python provide functions for escaping these characters (see re.escape); with JavaScript you have to write your own.

Here's mine:

RegExp.escape = function(text) {
  if (!arguments.callee.sRE) {
    var specials = [
      '/', '.', '*', '+', '?', '|',
      '(', ')', '[', ']', '{', '}', '\\'
    ];
    arguments.callee.sRE = new RegExp(
      '(\\' + specials.join('|\\') + ')', 'g'
    );
  }
  return text.replace(arguments.callee.sRE, '\\$1');
}

This deals with another common problem in JavaScript: compiling a regular expression once (rather than every time you use it) while keeping it local to a function. argmuments.callee inside a function always refers to the function itself, and since JavaScript functions are objects you can store properties on them. In this case, the first time the function is run it compiles a regular expression and stashes it in the sRE property. On subsequent calls the pre-compiled expression can be reused.

In the above snippet I've added my function as a property of the RegExp constructor. There's no pressing reason to do this other than a desire to keep generic functionality relating to regular expression handling the same place. If you rename the function it will still work as expected, since the use of arguments.callee eliminates any coupling between the function definition and the rest of the code.

Update 18th Feb 2025: 19 years after I published this RegExp.escape() has made it into the language!

Tags: escaping, javascript, regular-expressions