Is there a good reason why AntiXss.JavaScriptEncode wraps result in single quotes?

Question

I've been using Microsoft's AntiXss Library and was wondering if there is a good reason why its JavaScriptEncode method wraps the result in single quotes? That behavior seems unconventional.

Answer 1

Actually the new 3.0beta version has a flag JavaScriptEncode(string input, bool flagforQuote). Setting it to false, yields a result without quotes.

http://www.microsoft.com/downloads/details.aspx?familyid=051EE83C-5CCF-48ED-8463-02F56A6BFC09&displaylang=en

Answer 2

Probably to make sure it is returning a string. The usage I've seen is to take input and return a value that you can assign to a variable in javascript.

var message=<%=AntiXss.JavaScriptEncode(message)%>;

Now, no matter what was in message, the js variable message will have the exact input escaped appropriately so if some jerk tried to inject javascript into that message they'd just see the result of their message being assigned to the message variable.