does \' and \x27 in Javascript has any difference?

Question

I am reading the doc of owasp-java-encoder, it says that forJavaScriptBlock performs the same encode as forJavaScript with the exception that " and ' are encoded as \" and \' respectively. I don't understand why ' is encoded as \x27 in forJavaScript but endocded as \' in forJavaScriptBlock. What is the difference between \' and \x27?

Answer 1

The documentation for forJavaScript says:

Encodes for a JavaScript string. It is safe for use in HTML script attributes (such as onclick), script blocks, JSON files, and JavaScript source.

Since an HTML attribute can be delimited with ' characters, the content cannot include any ' characters. They have to be represented a different way.

forJavaScriptSource, on the other hand, says:

This method encodes for JavaScript strings contained within HTML script blocks. It is NOT safe for use in script attributes (such as onclick). The caller must provide the surrounding quotation characters. This method performs the same encode as forJavaScript(String) with the exception that " and ' are encoded as \" and \' respectively.

Unless you are interested in saving a few bytes of output or are writing a framework on top of this library, it is recommend that you use forJavaScript(String) over this method.