Pass variables to JavaScript in ExpressJS

Question

I am completely lost on this; I am using NodeJS to fetch a JSON and I need to pass the variable to my page and have JavaScript use the data.

app.get('/test', function(req, res) {     res.render('testPage', {         myVar: 'My Data'     }); 

That is my Express code (very simple for testing purposes); now using EJS I want to gather this data which I know to render on the page is simply

<%= myVar %> 

But I need to be able to gather this data in JavaScript (if possible within a .js file) but for now just to display the variable in an Alert box I have tried

In Jade it is like alert('!{myVar}') or !{JSON.stringify(myVar)}. Can I do something similar in EJS. I don't need any field like <input type=hidden> and taking the value of the field in javascript. If anyone can help be much appreciated

Answer 1

You could use this (client-side):

<script>   var myVar = <%- JSON.stringify(myVar) %>; </script> 

You could also get EJS to render a .js file:

app.get('/test.js', function(req, res) {   res.set('Content-Type', 'application/javascript');   res.render('testPage', { myVar : ... }); }); 

However, the template file (testPage) would still need to have the .html extension, otherwise EJS won't find it (unless you tell Express otherwise).

As @ksloan points out in the comments: you do have to be careful what myVar contains. If it contains user-generated content, this may leave your site open for script injection attacks.

A possible solution to prevent this from happening:

<script>   function htmlDecode(input){     var e = document.createElement('div');     e.innerHTML = input;     return e.childNodes.length === 0 ? "" : e.childNodes[0].nodeValue;   }   var myVar = JSON.parse(htmlDecode("<%= JSON.stringify(myVar) %>")); </script>