Skip to main content

js_escape

Function js_escape 

Source
pub fn js_escape(value: &str) -> String
Expand description

Escape a string for a JavaScript string literal in generated code.

The union of what the client, SSR, and server emitters each used to escape on their own: json_escape’s quotes, backslash, and control characters, plus <, >, and & so user data containing </script> can never close the surrounding tag or open an HTML entity when a module is inlined into a document, plus U+2028 and U+2029, which JSON permits raw but JavaScript treats as line terminators. One escape, one threat model, three emitters.