two php dynamic variable syntax passed in javascript function

Question

I am trying to pass two variables in a JavaScript function that pop up a confirmation box before deleting a record from the database MySQL, but I think there is something wrong in the syntax.

Below is the code of the link that fires the confirmation box when it is clicked but it doesn't work and I am not sure if I am passing the parameters in a right way:

echo"<td><a href='javascript:promptbox(" . $myemail . "," . $appNo .")'>cancel</a></td>";

Can someone please let me know whether its a syntax error or is there any other problem?

Thanks

You have an XSS hole.

SLaks
– SLaks

2013-09-02 03:11:12 +00:00
Commented Sep 2, 2013 at 3:11 — SLaks
– SLaks, Commented Sep 2, 2013 at 3:11

Hassan Khodadadeh · Accepted Answer · 2013-09-02 03:09:43Z

2

Strings in Javascript needs to be enclosed by quotes.

echo"<td><a href='javascript:promptbox(\"" . $myemail . "\",\"" . $appNo ."\")'>cancel</a></td>";

answered Sep 2, 2013 at 3:09

Hassan Khodadadeh

7,8984 gold badges47 silver badges72 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Hassan Khodadadeh Over a year ago

If those two variables are coming from users, please consider using htmlspecialchars to avoid XSS attacks!

Hassan Khodadadeh Over a year ago

@SLaks He may have to use it twice but it will prevent it! of course, NOT allowing dangerous chars would be much better and safer!

SLaks Over a year ago

@undone: No. HTML-escaping text does not help when concatenating Javascript.

Collectives™ on Stack Overflow

two php dynamic variable syntax passed in javascript function

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related