http://livedocs.adobe.com/ Macromedia LiveDocs - online documentation with user feedback. Copyright 2009, Macromedia, Inc. 2009-11-25T21:38:44 en-us http://livedocs.adobe.com/coldfusion/7/htmldocs/00000543.htm#33982 How about making "A string that is safe to use with JavaScript." more precise? Something like:<br /><br />"A String that is safe to use within a JavaScript literal string."<br /><br />That means that all chars that could end a JavaScript literal string are escaped, for example single and double quotes. <br /><br />I propose extending JSStringFormat: The chars "</script>" are acceptable within a literal string, but are not safe. Example:<br /><cfscript><br /> x = "</script><script>alert(document.cookie)</script>";<br /> x = JSStringFormat(x);<br /></cfscript><br /><cfoutput><br /><script>alert("Hola #x#")</script><br /><br />Resulting html:<br /><script>alert("Hola</script><script>alert(document.cookie)</script>")</script><br /><br />Other html tags can be used too. I propose that JSStringFormat additionally substitute '<' by '\u003C'.<br /><br />I also propose giving the complete list of substitutions that JSStringFormat does on this page, as there was in the livedocs for ColdFusion 6.0 version. Alexander Bunkenburg 0 0 2005-05-26T01:52:09 http://livedocs.adobe.com/coldfusion/7/htmldocs/00000543.htm#33938 The example is slightly off.<br />A tab is chr (9), backspace is chr(8).<br /><br />This might be a better example:<br /><!--- This example shows the use of the JSStringFormat function. ----><br /><CFOUTPUT><br /> <h3>JSStringFormat</h3><br /> <cfset stringValue = "An example string value with a tab#chr(9)# chr(9),<br /> a newline#chr(10)# (chr10) and some ""quoted"" 'text'"><br /><br /> <p><br /> This is the string we have created:<br><br /> #stringValue#<br /> </p><br /> <p><br /> View the HTML source to verofy that the control characters are indeed there.<br /> </p><br /><br /> <cfset jsStringValue = JSStringFormat (#stringValue#)><br /><br /> <!----- Generate an alert from the JavaScript string jsStringValue. ----><br /> <SCRIPT><br /> s = "#jsStringValue#";<br /> alert (s);<br /> </SCRIPT><br /></CFOUTPUT> MikerRoo 0 0 2005-05-24T20:05:25