为什么在渲染部分之前使用 escape_javascript?

2022-01-31 00:00:00 ruby-on-rails javascript

I'm looking at this Railscast episode and wondering why the call to escape_javascript is needed here:

$("#reviews").append("<%= escape_javascript(render(:partial => @review)) %>");

What is escape_javascript used for?

According to the Rails docs:

escape_javascript(javascript)

Escape carrier returns and single and double quotes for JavaScript segments.

But that doesn't mean much to me.

解决方案

Because you don't want users posting JavaScript that the browser actually executes?

相关文章