Is there a good alternative to having JavaScript code as string literals in my ASP.net code?
<p>Working on an ASP.net web application, I've been wondering if there is a good way to avoid writing JavaScript code in string literals in my ASP.net code.  See here: <a href="http://www.4guysfromrolla.com/articles/030202-1.aspx" rel="nofollow">http://www.4guysfromrolla.com/articles/030202-1.aspx</a>. </p>

<p>In the linked example, I see code that looks like:  </p>

<pre><code>Private Sub Calendar1_SelectionChanged(sender As Object, e As EventArgs)
  Dim strjscript as string = "&lt;script language=""javascript""&gt;"
  strjscript &amp;= "window.opener." &amp; _
        Httpcontext.Current.Request.Querystring("formname") &amp; ".value = '" &amp; _
        Calendar1.SelectedDate &amp; "';window.close();"
  strjscript = strjscript &amp; "&lt;/script" &amp; "&gt;" 'Don't Ask, Tool Bug

  Literal1.Text = strjscript  'Set the literal control's text to the JScript code
End Sub
</code></pre>

<p>I'm not used to using much JavaScript.  A lot of the code that I've worked with has been mostly server-side coding with T-SQL.  The above code gives me a headache just looking at it.  Not only is it ugly, but it shows a pattern where a malicious user could try to inject malicious code.</p>

<p>Is there a better way to avoid manipulating JavaScript code as string literals?  Think of the ways we have to avoid manipulating T-SQL code as string literals.</p>
