Escaping Qualtrics for text in text for use in javascript (in general, how to safely avoid user-generated text)

In my Qualtrics poll, I have a question with a free answer (text box). I would like to get an answer to this question in javascript so that I can perform complex text processing and post the result on an external page.

It seems that the official Qualtrics way is to use text code in the form of channels:

var answer = "${q://QID1/ChoiceTextEntryValue}" 

But this generates javascript code with a literal response inserted into the code. If the questionnaire puts a quote sign in their answer, it will violate the code. I also verified that it can be used to input arbitrary javascript!

Is it safe to assign a user-generated variable?

What I tried:

  • It would be nice if there was an API call that passed the response directly to the javascript variable without using a text message. I reviewed their API documentation and talked with technical support, and it seems like such a function does not exist.
  • It would also be useful if Qualtrics had a built-in character replacement feature that I could use to highlight quotes, but I don't think so.
  • I could use a response check so that respondents do not send a response that contains quotation marks. This is the only workable solution that I came up with, but it will annoy users.
+6
source share

Source: https://habr.com/ru/post/979007/


All Articles