How do I properly escape quotes inside HTML attributes?

&quot; is the correct way, the third of your tests: <option value=”&quot;asd”>test</option> You can see this working below, or on jsFiddle. alert($(“option”)[0].value); <script src=”https://ajax.googleapis.com/ajax/libs/jquery/2.1.1/jquery.min.js”></script> <select> <option value=”&quot;asd”>Test</option> </select> Alternatively, you can delimit the attribute value with single quotes: <option value=””asd”>test</option>

Objective C HTML escape/unescape

Check out my NSString category for XMLEntities. There’s methods to decode XML entities (including all HTML character references), encode XML entities, stripping tags and removing newlines and whitespace from a string: – (NSString *)stringByStrippingTags; – (NSString *)stringByDecodingXMLEntities; // Including all HTML character references – (NSString *)stringByEncodingXMLEntities; – (NSString *)stringWithNewLinesAsBRs; – (NSString *)stringByRemovingNewLinesAndWhitespace;

Component to inject and interpret String with HTML code into JSF page

JSF by default escapes HTML from backing bean properties in order to prevent XSS attack holes. To disable this, just set the escape attribute of the <h:outputText> to false. <h:outputText … escape=”false” /> This way the HTML won’t be escaped and will thus be interpreted by the webbrowser. Unrelated to the concrete problem, beware of … Read more

How should I escape strings in JSON?

Ideally, find a JSON library in your language that you can feed some appropriate data structure to, and let it worry about how to escape things. It’ll keep you much saner. If for whatever reason you don’t have a library in your language, you don’t want to use one (I wouldn’t suggest thisĀ¹), or you’re … Read more