Documentation / @zerotal/flow / index / jsLiteral
Function: jsLiteral()
jsLiteral(
value):string
Defined in: flow/src/utils.ts:44
Encode a value as a JavaScript string literal for embedding in an Alpine expression.
An x-on:click / x-show / :class attribute is executable code, not display text, so
HTML escaping is the wrong tool: escapeAttr lets an expression through intact and the
browser hands Alpine exactly what was written. Interpolating a value into '…' by hand
therefore turns any user-controlled string — a workspace slug, a tab name — into stored
XSS against every viewer. JSON.stringify produces a literal with quotes, backslashes and
line terminators already escaped; the surrounding attribute escaping then handles the HTML
layer, and Alpine sees the original value.
Parameters
value
unknown
The value to embed.
Returns
string
A JavaScript string literal, quotes included.
Example
"x-on:click": `tab = ${jsLiteral(name)}` // tab = "my-tab"