Verify a php variable if there is a javascript code

Question

I have some variables in PHP (strings) and I vould like to check if inside of those strings I have some javascript code. If so, I would like to make this code inactive and be displayed as string on the website, not to be executed as javascript code.

This will be a kind of security method.

Is there a method to do it in php? If you could give me an example, it's even better.

Thank you very much for your help.

Brad · Accepted Answer · 2012-07-24 12:33:15Z

7

You should be using htmlspecialchars() for any content you output into HTML. It escapes any HTML entities so that they are not taken literally. For example, < becomes <. This also solves your problem.

http://php.net/manual/en/function.htmlspecialchars.php

answered Jul 24, 2012 at 12:33

Brad

164k57 gold badges380 silver badges559 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

Milos Cuculovic Over a year ago

Thank you very much @Brad. The htmlspecialchars will transform some special characters like & (ampersand) becomes & " (double quote) becomes " ' (single quote) becomes ' < (less than) becomes < > (greater than) becomes > in html. With that, the javascript execution will be avoid, right?

Brad Over a year ago

@Ana, That is correct, unless you were to wrap that output in <script> tags. The concept is that without <script> tags, the JavaScript can't execute. It just appears as text on the page. There is no way for someone to insert <script> tags, as they would turn out to be <script>.

Milos Cuculovic Over a year ago

Great, thank you very much. I will take a couple of minutes to checki if this solution is properly adapted to my code and I will let you know as soon as possible.

Milos Cuculovic Over a year ago

I am here again. The solution is perfectly adapted to my needs. Thank you.

Community · Accepted Answer · 2017-05-23 10:34:51Z

2

In addition to Brad's answer, consider reading the first answer here for a short summary and then the therein mentioned article afterwards.

This can help you to easily avoid outputting unsafe strings by accident.

edited May 23, 2017 at 10:34

CommunityBot

11 silver badge

answered Jul 24, 2012 at 12:43

phant0m

17k6 gold badges52 silver badges84 bronze badges

1 Comment

Brad Over a year ago

Of course, but the link is much appreciated. Not sure how I've missed this over the years...

Collectives™ on Stack Overflow

Verify a php variable if there is a javascript code

2 Answers 2

4 Comments

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

4 Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related