如何实现高效的JavaScript字符串字面量转字符串函数？

Great question! Dealing with string literals that contain escaped quotes (or other escape sequences) without relying on eval() is a common need—especially since eval() comes with performance drawbacks and security risks if you're handling untrusted input. Let's walk through a couple of solid solutions.

Option 1: Use JSON.parse() (Simple & Efficient) #

If your string literal follows JSON syntax (which aligns closely with JavaScript string rules for most cases), JSON.parse() is the fastest and safest approach. It natively handles escaped characters like ", \n, \\, etc., without executing any code.

Here's the function:

function convertStringLiteralToString(str) {
  try {
    return JSON.parse(str);
  } catch (error) {
    // Fallback if the input isn't valid JSON (e.g., contains JS-specific escapes like \v)
    console.warn("Could not parse string literal as JSON:", error);
    return str;
  }
}

Test it out: #

var stringLiteral = "\" hi world \"";
var string = convertStringLiteralToString(stringLiteral);
console.log(string); // Output: " hi world "

This works because JSON.parse() takes the string literal (formatted like a JSON string) and converts it into the actual string value it represents.

Option 2: Custom Escape Sequence Parser (For JS-Specific Cases) #

JSON doesn't support all JavaScript escape sequences (like \v for vertical tabs or \x00 for null characters). If you need to handle these edge cases, you can build a custom function to manually replace escape sequences with their corresponding characters.

Here's a robust version:

function convertStringLiteralToString(str) {
  return str.replace(/\\(?:([nrbtfv\\'"])|\x([0-9A-Fa-f]{2})|u([0-9A-Fa-f]{4}))/g, 
    function(match, charEscape, hexEscape, unicodeEscape) {
      if (charEscape) {
        // Handle single-character escapes
        switch(charEscape) {
          case 'n': return '\n';
          case 'r': return '\r';
          case 't': return '\t';
          case 'b': return '\b';
          case 'f': return '\f';
          case 'v': return '\v';
          default: return charEscape; // Covers \\, ", '
        }
      } else if (hexEscape) {
        // Handle \xHH hex escapes
        return String.fromCharCode(parseInt(hexEscape, 16));
      } else if (unicodeEscape) {
        // Handle \uHHHH unicode escapes
        return String.fromCharCode(parseInt(unicodeEscape, 16));
      }
      return match; // Fallback for unrecognized escapes
    }
  );
}

Test with JS-specific escapes: #

var stringLiteral = "\"Hello\\vWorld!\\x41\"";
console.log(convertStringLiteralToString(stringLiteral)); 
// Output: "HelloWorld!A" (includes vertical tab and 'A' from \x41)

Why Avoid eval()? #

You mentioned eval() would be "perfect" if not for speed—and that's true, but it's also risky. eval() executes the input as JavaScript code, which means if your string literal comes from an untrusted source, it could run malicious code. Plus, eval() is much slower than dedicated parsers like JSON.parse() because it has to fire up the entire JavaScript engine to execute the string.

内容的提问来源于stack exchange，提问作者Ben Rivers