Even though they're unnecessary in most cases, you have several options for returning HTML with proper quotes around filenames and other attributes:
<% Response.write "<a href='somepage.asp'>Some Text</a>" Response.write "<a href=""somepage.asp"">Some Text</a>" Response.write "<a href=" & chr(34) & "somepage.asp" & chr(34) & ">Some Text</a>" %> |
In server-side JScript/JavaScript:
<script language=JScript Runat=SERVER> Response.Write("<a href='somepage.asp'>Some Text</a>"); Response.Write("<a href=\"somepage.asp\">Some Text</a>"); Response.Write('<a href=\'somepage.asp\'>Some Text</a>'); </script> |
Now, it can get tricky if you are returning client-side code that needs specific apostrophes and quotes, for example if I have a string in ASP and I need to return it to client-side script so that JavaScript can pop up an alert, I have to get a bit creative.
<% str = "Mr. O'Brien said ""no way!""" Response.Write("<SCRIPT>alert('" & Replace(str, "'", "\'") & "');</SCRIPT>") ' or Response.Write("<SCRIPT>alert(""" & Replace(str, CHR(34), "\" & CHR(34)) & """);</SCRIPT>") %> |
There are far more complicated scenarios than this, but that should give you a bit of a heads-up.