ejs | 易学教程

Passing vars from ejs to javascript (server to client on render) while avoiding XSS issues

阅读更多关于 Passing vars from ejs to javascript (server to client on render) while avoiding XSS issues

问题 It seems like the accepted way to pass variables to JavaScript using ejs is like so: <script> var foo = <%- JSON.stringify(foo) %>; </script> But I've ran into XSS issues using this method, and wanted to know if there was a better/safer way. This example shows the vulnerability. This works since JSON.stringify("</script><script>alert('test')</script><script>") returns "</script><script>alert('test')</script><script>" and the <%- %> operators do not escape the result. It also works for objects

Can't Render EJS Template on Client

阅读更多关于 Can't Render EJS Template on Client

问题 I'm coding an application on express, and I'm using ejs as a view/template engine. At path /artists , I'm rendering the view artists.ejs which has artists covers. When clicking on a cover, I want an AJAX call to retrieve the corresponding data, place it in my template/view for artist artist.ejs and display this template in my HTML under the cover. I've seen this related question but it has not solved my use case. Everything seems clear, but I can't render the data with the template. I would

Pass data through to the view in Express

阅读更多关于 Pass data through to the view in Express

问题 I am trying to pass through the result of a query through to my view in Express. The query is made using mongodb which counts the total points of the collective users. When I try to pass the count through as a variable, I get ReferenceError: /Sites/test/views/dashboard.ejs:76 which refers to <%= totalpoints %> in my ejs view. Below is my code in app.js app.get('/dashboard', function(req, res) { User.find({}, function(err, docs) { console.log(docs); }); User.find({ points: { $exists: true } },

Multiple sql queries in nodejs

阅读更多关于 Multiple sql queries in nodejs

问题 I am new in nodejs.I am developing a demo app using nodeJs.I have problem while run multiple queries.My Code is like: exports.dashboard = function(req, res){ req.getConnection(function(err,connection){ var id = req.session.userId; var queryData = "SELECT node_questions.question_name,node_questions.description FROM node_questions LEFT JOIN node_user ON node_questions.user_id=node_user.id"; var query = connection.query(queryData,'SELECT * FROM node_user Where id = ?',[id],function(err,rows) {

How do I escape EJS template code in node.js to be evaluated on the client side?

阅读更多关于 How do I escape EJS template code in node.js to be evaluated on the client side?

问题 I use node.js/ejs on the server side and backbone.js on the client side. Both server side and client side use the same templating style. So the problem is, if I put template code meant for the client inside a template it still get's parsed on the server side. If found out that something like this works: <%- "<%= done ? 'done' : '' %\>" %> However, IMHO this uglifies the code in a way which makes the whole point of using templates useless. How would you approach this? Is there a way to define

how to access assets/images from the view in Sails.js?

阅读更多关于 how to access assets/images from the view in Sails.js?

问题 I simply want to add an image in a view in my Sails-Project My view-file has the location views/album/albums.ejs and the image is located in assets/images/placeholder.png if I add the image like this <img src="../../assets/images/placeholder.png"> I get this error GET http://localhost:1337/assets/images/placeholder.png 404 (Not Found) Am I missing something? 回答1: Sails use Grunt (Gruntfile.js in root of project) to execute some tasks during sails lift. One of that tasks is to copy files from

EJS - pass variable when include

阅读更多关于 EJS - pass variable when include

问题 I'm using ejs in backend with nodejs. I'd like to pass variable when include. When include the header, pass the page title. index.ejs: <% include header %> <body> . . . </body> <% include footer%> header.ejs: <html lang="en"> <head> <title><%- my_tytle %></title> </head> footer.ejs: </html> How to pass my_title in the include command? 回答1: You can pass the object inside the include statement <%- include("header",{title:"your_title"}) %> 回答2: you can pass my_tytle directly to the index.ejs and

Adding local script files to EJS views

阅读更多关于 Adding local script files to EJS views

问题 I've got a Node/Express/EJS app. It's got a folder for views and another for client files. The latter has another folder for javascript, where I have a file called frontend.js. I'd like to load jQuery and the frontend.js file in this view. The standard script tags don't work. <script src="//ajax.googleapis.com/ajax/libs/jquery/1.11.1/jquery.min.js"></script> <script type="text/javascript" src="../client/js/frontend.js"></script> jQuery loads, frontend.js throws a 404 error. Is there a special

How do I stop getting this ReferenceError in node.js?

阅读更多关于 How do I stop getting this ReferenceError in node.js?

问题 183| }); 184| >> 185| <% if(just_registered) { %> 186| alert("Welcome!"); 187| <% } %> 188| just_registered is not defined Basically, I want to say: if just_registered is defined and is true, then alert. However, I want want to set everything to false...I just want to leave it undefined (i have like 100 variables) 回答1: <% if(typeof just_registered !== "undefined") { %> Basically your checking whether a local variable exists. To do this you have to use the typeof operator since accessing just

Change .ejs extension to .html using Parse.com Express.js

阅读更多关于 Change .ejs extension to .html using Parse.com Express.js

问题 How would I go about using .html extensions on my view files instead of .ejs when using Parse.com's Express.js? I changed the EJS delimiters to <? and ?> because I'm used to them from PHP. That worked fine, but I can't seem to change the file extension for my view files: I've tried the following: var express = require('express'); var ejs = require('ejs'); var app = express(); ejs.open = '<?'; ejs.close = '?>'; app.set('view engine', 'ejs'); app.engine('.html', ejs.renderFile); app.set('views'