Huge News!Announcing our $40M Series B led by Abstract Ventures.Learn More
Socket
Sign inDemoInstall
Socket

slashes

Package Overview
Dependencies
Maintainers
1
Versions
22
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

slashes - npm Package Compare versions

Comparing version 1.0.5 to 2.0.0

lib-commonjs/addSlashes.d.ts

98

package.json
{
"name": "slashes",
"version": "1.0.5",
"description": "Add or strip backslashes.",
"main": "slashes.js",
"scripts": {
"test": "echo \"Error: no test specified\" && exit 1"
"version": "2.0.0",
"license": "ISC",
"author": {
"name": "Chris Ackerman",
"email": "chris@topher.land"
},
"repository": {
"type": "git",
"url": "git://github.com:ChrisAckerman/node-slashes"
"url": "git://github.com:ChrisAckerman/slashes"
},
"main": "lib-commonjs/index.js",
"module": "lib/index.js",
"files": [
"README.md",
"css/",
"dist/",
"lib-commonjs/",
"lib/",
"scss/"
],
"scripts": {
"start": "run-script build:commonjs && node ./lib-commonjs/repl.js",
"test": "run-script eslint && run-script tsc --noEmit && run-script jest",
"clean": "del-cli lib lib-commonjs dist css coverage && jest --clearCache",
"build": "run-script clean && run-script build:js && run-script build:commonjs && run-script build:d.ts && run-script build:cleanup",
"build:cleanup": "del-cli \"lib?(-*)/**/@(__demo__|__snapshots__|?(*.)test.@(ts|tsx|js|jsx))\"",
"build:commonjs": "cross-env NODE_ENV=production BABEL_MODULES=cjs babel src --out-dir lib-commonjs --extensions .ts,.tsx,.js,.jsx --copy-files --source-maps",
"build:d.ts": "run-script tsc --emitDeclarationOnly && run-script tsc --emitDeclarationOnly --outDir lib-commonjs",
"build:js": "cross-env NODE_ENV=production BABEL_MODULES=false babel src --out-dir lib --extensions .ts,.tsx,.js,.jsx --copy-files --source-maps",
"eslint": "eslint \"src/**/*.{js,jsx,ts,tsx}\" --ignore-pattern \"/__demo__/\" --no-error-on-unmatched-pattern",
"jest": "cross-env NODE_ENV=test jest --passWithNoTests",
"prepack": "run-script build",
"reformat": "run-script eslint --fix --quiet",
"tsc": "tsc"
},
"devDependencies": {
"@babel/cli": "^7.8.4",
"@babel/core": "^7.8.4",
"@babel/generator": "^7.8.4",
"@babel/plugin-proposal-class-properties": "^7.8.3",
"@babel/plugin-proposal-decorators": "^7.8.3",
"@babel/plugin-proposal-object-rest-spread": "^7.8.3",
"@babel/plugin-transform-typescript": "^7.8.3",
"@babel/preset-env": "^7.8.4",
"@types/jest": "^25.1.3",
"@types/node": "^13.7.4",
"@typescript-eslint/eslint-plugin": "^2.21.0",
"@typescript-eslint/parser": "^2.21.0",
"@xornot/run-script": "^0.1.2",
"babel-core": "^7.0.0-bridge.0",
"babel-jest": "^25.1.0",
"babel-plugin-const-enum": "^0.0.5",
"cross-env": "^7.0.0",
"del-cli": "^3.0.0",
"eslint": "^6.8.0",
"eslint-config-prettier": "^6.10.0",
"eslint-plugin-prettier": "^3.1.2",
"eslint-plugin-react": "^7.18.3",
"jest": "^25.1.0",
"prettier": "^1.19.1",
"typescript": "^3.8.2"
},
"keywords": [
"add",
"escape",
"unescape",
"slashes",
"php",
"strip",
"remove",
"sequence",
"encode",
"decode",
"backslash",
"slash",
"backslash",
"escape",
"unescape",
"php"
],
"author": "Chris Ackerman <bluejeansandrain@gmail.com>",
"license": "MIT",
"bugs": {
"url": "https://github.com/ChrisAckerman/node-slashes/issues"
},
"homepage": "https://github.com/ChrisAckerman/node-slashes"
"unicode",
"ascii",
"utf8",
"utf16",
"control",
"char",
"character",
"unprintable",
"printable",
"codepoint",
"codeblock",
"supplemental",
"supplementary"
]
}

171

README.md

@@ -1,96 +0,141 @@

# slashes
# Slashes
Add or strip backslashes.
Provides two methods, `add` and `strip` which are almost the same as PHP's `addslashes` and `stripslashes` functions
respectively.
If you were previously using v1, see the [migration](./MIGRATION.md) document for guidance on switching to v2.
The `add` method will prefix backslash (`\`), double quote (`"`), and single quote (`'`) characters with backslashes.
Null (`\0`) characters will be replaced with backslash zero `"\\0"`, and newline (`\n`) characters will be replaced with
`"\\n"`. The newline replacement differs from PHP because JavaScript has ASI (auto semicolon insertion) at the end of
each line, so a newline in a JavaScript string literal does not preserve the newline character correctly.
# Getting Started
The `strip` method replaces all sequences of two characters that start with a backslash, with the second character in
the sequence. There are three caveats. A single non-escaped slash at the end of the string will be removed. Backslash
zero `"\\0"` will become a null (`\0`) character. Backslash 'n' `"\\n"` will become a newline (`\n`) character.
```ts
import { addSlashes, stripSlashes } from 'slashes';
// Or using CommonJS require.
const { addSlashes, stripSlashes } = require('slashes');
The goal of this utility is to make a string safe for concatenation or injection into JavaScript source.
```js
var foo = "\\bar";
var source = "console.log('" + bar + "');";
eval(source);
addSlashes(`foo\nbar`) === `foo\\nbar`; // true
stripSlashes(`foo\\nbar`) === `foo\nbar`; // true
```
You might expect the above snippet to output `\bar` but instead you will see `ar`, because the source string ends up
being `console.log('\bar');` which is interpreted as starting with an escaped "b" rather than a backslash and then a
"b". It can be fixed using the `add` method.
You can also experiment using a pre-configured REPL by running the `npm start` command.
```js
var foo = "\\bar";
var source = "console.log('" + slashes.add(bar) + "');";
eval(source);
# API
## Adding Slashes
### **Function** `addSlashes(str: string): string`
Returns a string with the following default characters escaped:
- backspace (`"\b"` -> `"\\b"`)
- form feed (`"\f"` -> `"\\f"`)
- newline (`"\n"` -> `"\\n"`)
- carriage return (`"\r"` -> `"\\r"`)
- horizontal tab (`"\t"` -> `"\\t"`)
- vertical tab (`"\v"` -> `"\\v"`)
- null (`"\0"` -> `"\\0"`)
- single quote (`"'"` -> `"\\'"`)
- double quote (`"\""` -> `"\\\""`)
- backslash (`"\\"` -> `"\\\\"`)
All `addSlashes` overloads use the above as the default character set to escape if no explicit character set is given.
```ts
addSlashes(`\b\f\n\r\t\v\0'"\\`) === `\\b\\f\\n\\r\\t\\v\\0\\'\\"\\\\`; // true
```
Now the source comes out as `console.log('\\bar');` and the output will be `\bar`.
### **Function** `addSlashes(str: string, characters: string): string`
## Install
An `addSlashes` overload which returns a string with _only_ the characters in the `characters` string escaped. The explicit characters completely override the default character set. The default characters string is: `"\b\f\n\r\t\v\0'\"\\"`.
```sh
npm install slashes --save
```ts
addSlashes(`foo\nbar`, `oa`) === `f\\o\\o\nb\\ar`; // true
```
## Usage
Characters in the unicode supplementary range (code points > 65535) are _always_ converted to a unicode escape surrogate pairs. This is because Javascript strings are UTF-16, which actually sees these as two characters (`"😊".length === 2`). So, using 😊 in the `characters` string is actually setting two escapable characters which are _not valid individually._ If the "😊" character were not escaped to two unicode escape sequences, you would end up with a string containing invalid characters which would print like this: `"\\�\\�"`, instead of valid characters: `"\\ud83d\\ude0a"`.
```ts
addSlashes(`foo😊bar`, `😊`) === `foo\\ud83d\\ude0abar`; // true
```
slashes.add(string, [number])
slashes.strip(string, [number])
### **Function** `addSlashes(str: string, count: number): string`
An `addSlashes` overload which returns a string with `count` layers of slashes added to the default escape character set. This is the same as recursively invoking this function `count` times.
```ts
addSlashes(`"foo\nbar"`, 2) === `\\\\\\"foo\\\\nbar\\\\\\"`; // true
addSlashes(addSlashes(`"foo\nbar"`)) === `\\\\\\"foo\\\\nbar\\\\\\"`; // true
addSlashes(`"foo\nbar"`, 2) === addSlashes(addSlashes(`"foo\nbar"`)); // true
```
If a non-string value is passed as the first parameter, it will be coerced to a string.
### **Function** `addSlashes(str: string, count: number, characters: string): string`
If a non-number is passed as the second parameter, it will be coerced to a number. Negative numbers are equivalent to
their positive counter parts. Zero is the same as one.
An `addSlashes` overload which accepts both a `count` and `characters` parameter.
### Examples
```js
var slashes = require('slashes');
### **Function** `addSlashes(str: string, options: IAddSlashesOptions): string`
var test = "'test'\n\"ing\"\0";
var added = slashes.add(test);
var stripped = slashes.strip(added);
An `addSlashes` overload which accepts an options object.
console.log("test:\n%s\n", test);
console.log("added:\n%s\n", added);
console.log("stripped:\n%s\n", stripped);
- `options` Configurable options for adding slashes to a string. Can have the following fields:
- `count` Number of times to add slashes to the string.
- `characters` A string of characters that should be escaped with slashes.
- `escapeNonAscii` When true, all non-ASCII characters (unicode code points > 127) will be converted to `\x` or `\u` escape sequences.
```ts
addSlashes(`†©`, { count: 2, characters: `†©\\`, escapeNonAscii: true }) === `\\\\u2020\\\\xa9`; // true
```
Output should be...
## Stripping Slashes
### **Function** `stripSlashes(str: string): string`
Returns a string with one layer of slashes removed. It will convert all ES6 escape sequences into their corresponding characters. Slashes which are not part of a recognized escape sequence are removed, and the following character is left in place.
```ts
stripSlashes(`\\b\\f\\n\\r\\t\\v\\0\\xa9\\u2020\\u{1f60a}\\a\\\\`) === `\b\f\n\r\t\v\0©†😊a\\`; // true
```
test:
'test'
"ing"
added:
\'test\'
\"ing\"\0
If a `\u{...}` escape sequence has a code point greater than 0x10ffff, the slash is removed and the `u{...}` suffix is left as a literal string.
stripped:
'test'
"ing"
```ts
stripSlashes(`\\u{110000}`) === `u{110000}`; // true
```
### **Function** `stripSlashes(str: string, count: number): string`
A `stripSlashes` overload which returns a string with `count` layers of slashes removed. This is the same as recursively invoking this function `count` times.
```ts
stripSlashes(`\\\\n\\\\a\\\\\\\\`, 2) === `\na\\`; // true
stripSlashes(stripSlashes(`\\\\n\\\\a\\\\\\\\`)) === `\na\\`; // true
stripSlashes(`\\\\n\\\\a\\\\\\\\`, 2) === stripSlashes(stripSlashes(`\\\\n\\\\a\\\\\\\\`)); // true
```
Both methods also take an optional second number parameter, 1 or greater. This is equivalent to calling the method
that many times.
```js
slashes.add(string, 2);
// ...is the same as...
slashes.add(slashes.add(string));
### **Function** `stripSlashes(str: string, options: IStripSlashesOptions): string`
slashes.strip(string, 2);
// ...is the same as...
slashes.strip(slashes.strip(string));
A `stripSlashes` overload which accepts an options object.
- `options` Configurable options for stripping slashes from a string. Can have the following fields:
- `count` Number of times to strip slashes from the string.
- `defaultEscapeValue` The default value for all escape options (b, f, n, r, t, v, 0, x, u, and uEs6). When true, escape options must be explicitly disabled. When false, escape options must be explicitly enabled. Defaults to true.
- `b` True to convert `"\\b"` escapes into backspace characters. Defaults to `defaultEscapeValue`.
- `f` True to convert `"\\f"` escapes into form feed characters. Defaults to `defaultEscapeValue`.
- `n` True to convert `"\\n"` escapes into newline (line feed) characters. Defaults to `defaultEscapeValue`.
- `r` True to convert `"\\r"` escapes into carriage return characters. Defaults to `defaultEscapeValue`.
- `t` True to convert `"\\t"` escapes into horizontal tab characters. Defaults to `defaultEscapeValue`.
- `v` True to convert `"\\v"` escapes into vertical tab characters. Defaults to `defaultEscapeValue`.
- `0` True to convert `"\\0"` escapes into null characters. Defaults to `defaultEscapeValue`.
- `x` True to convert `"\\x##"` escapes (where `##` is a hex single byte unicode code point) into unicode characters. Defaults to `defaultEscapeValue`.
- `u` True to convert `"\\u####"` escapes (where `####` is a hex two byte unicode code point) into unicode characters. Defaults to `defaultEscapeValue`.
- `uEs6` True to convert `"\\u{#...}"` escapes (where `#...` is a hex unicode code point) into unicode characters. Defaults to `u`.
If an escape option is false, then the corresponding escape sequence will be treated like any other backslash before a non-escape character. The backslash will be removed, and all trailing characters left untouched.
```ts
stripSlashes(`\\\\tfoo\\\\nbar`, {
// Strip slashes twice.
count: 2,
// All escape sequences are disabled by default.
defaultEscapeValue: false,
// Enable newlines escapes explicitly.
n: true
}) === `tfoo\nbar`; // true
```
Note that in JavaScript, `"\0"` and `"\u0000"` are identical. The `add` method will convert both to `"\\0"`.
SocketSocket SOC 2 Logo

Product

  • Package Alerts
  • Integrations
  • Docs
  • Pricing
  • FAQ
  • Roadmap
  • Changelog

Packages

npm

Stay in touch

Get open source security insights delivered straight into your inbox.


  • Terms
  • Privacy
  • Security

Made with ⚡️ by Socket Inc