hugo/content/functions/safeJS.md

---
title: safeJS
# linktitle:
description: Declares the provided string as a known safe JavaScript string.
godocref: https://golang.org/src/html/template/content.go?s=2548:2557#L51
date: 2017-02-01
publishdate: 2017-02-01
lastmod: 2017-02-01
categories: [functions]
menu:
  docs:
    parent: "functions"
keywords: [strings]
signature: ["safeJS INPUT"]
workson: []
hugoversion:
relatedfuncs: []
deprecated: false
draft: false
aliases: []
---

In this context, *safe* means the string encapsulates a known safe EcmaScript5 Expression (e.g., `(x + y * z())`).

Template authors are responsible for ensuring that typed expressions do not break the intended precedence and that there is no statement/expression ambiguity as when passing an expression like `{ foo:bar() }\n['foo']()`, which is both a valid expression and a valid program with a very different meaning.

Example: Given `hash = "619c16f"` defined in the front matter of your `.md` file:

* <span class="good">`<script>var form_{{ .Params.hash | safeJS }};…</script>` &rarr; `<script>var form_619c16f;…</script>`</span>
* <span class="bad">`<script>var form_{{ .Params.hash }};…</script>` &rarr; `<script>var form_"619c16f";…</script>`</span>
Squashed 'docs/' content from commit f887bd7b git-subtree-dir: docs git-subtree-split: f887bd7b4e3e7c7e76cd63951e5b0d37d8fe0ac7 2017-08-10 11:18:22 -04:00			`---`
			`title: safeJS`
			`# linktitle:`
			`description: Declares the provided string as a known safe JavaScript string.`
			`godocref: https://golang.org/src/html/template/content.go?s=2548:2557#L51`
			`date: 2017-02-01`
			`publishdate: 2017-02-01`
			`lastmod: 2017-02-01`
			`categories: [functions]`
			`menu:`
			`docs:`
			`parent: "functions"`
Squashed 'docs/' changes from 44fe0285..32356e4e 32356e4e Fix typo in header of shortcode-templates.md c8f1a2d2 Correct code example for index template function bfa6a55d Escape code fencing ff8b2f99 Fix typos in deployment with wercker tutorial 557c36e8 theme: Merge commit '7fbb4bed25001182bfeb91f79db0f0c1936582ee' 7fbb4bed Squashed 'themes/gohugoioTheme/' changes from 7dd8a302..ca53082d ce31cee0 Add "See Also" config 158cee1b Make the tags into keywords 61600be6 Add a note to the related section 49edb5a2 Relase 0.27.1 c9bbc001 releaser: Add release notes to /docs for release of 0.27.1 213c6c3b Add bugs poster 8b4590cd Add KeyCDN integration tutorial 2b277859 Add tutorial videos to several docs pages 950fef1f Update roadmap to link to the correct milestones page 496f5bf6 Rename relnotes d6f9378d Bump Netlify versions to 0.27 087fde7f Update 0.27 release notes 603f94ae docs: Document Related Content 3790f6a3 releaser: Bump versions for release of 0.27 0948868c releaser: Add release notes to /docs for release of 0.27 git-subtree-dir: docs git-subtree-split: 32356e4eabe357ae914f4d1d59e8ae31ce936723 2017-09-21 13:03:00 -04:00			`keywords: [strings]`
Squashed 'docs/' content from commit f887bd7b git-subtree-dir: docs git-subtree-split: f887bd7b4e3e7c7e76cd63951e5b0d37d8fe0ac7 2017-08-10 11:18:22 -04:00			`signature: ["safeJS INPUT"]`
			`workson: []`
			`hugoversion:`
			`relatedfuncs: []`
			`deprecated: false`
			`draft: false`
			`aliases: []`
			`---`

			In this context, safe means the string encapsulates a known safe EcmaScript5 Expression (e.g., `(x + y * z())`).

			Template authors are responsible for ensuring that typed expressions do not break the intended precedence and that there is no statement/expression ambiguity as when passing an expression like `{ foo:bar() }\n['foo']()`, which is both a valid expression and a valid program with a very different meaning.

			Example: Given `hash = "619c16f"` defined in the front matter of your `.md` file:

			* <span class="good">`<script>var form_{{ .Params.hash \| safeJS }};…</script>` → `<script>var form_619c16f;…</script>`</span>
			* <span class="bad">`<script>var form_{{ .Params.hash }};…</script>` → `<script>var form_"619c16f";…</script>`</span>