JS inside PHP Escape String (for functions)

Question

I have a PHP script that generates some Javascript for me in a manner like this:

foreach ($array as $element)
{
    echo '<a onClick="myFunctionTakesPHPValues('.$element[0].','.$element[1].')">'.$element[2].'</a>';
}

My problem is that how can I escape so that the Javascript bit will look more like

<a onClick='MyFunctionTakesPHPValues("'.$element[0].','.$element[1].'")>'.$element[2].'</a>';

I hope this makes sense. The short version is that I feel i need triple quotes inside double quotes inside single quotes, but there is no such thing as triple quotes, but I believe there is some way to escape quotes to nest it up three times.

Use backslash before your string-delimiter quotes. \' or \" — Niccolò Campolungo
– Niccolò Campolungo, Commented Jun 25, 2013 at 7:00
-1. Nothing personal but just to make this question less relevant in search — Your Common Sense
– Your Common Sense, Commented Jun 25, 2013 at 7:40
I can understand that, however judging from your comments to the other answer and the answer that is more or less the same as it could imply that there are many people out there with security breaches as a result of not understanding this properly. Cheers for your answer though. Would htmlspecialchars be as safe as json_encode, I seem to get quotes around all my strings when I use json_encode but not with htmlspecialchars. And I could only properly use json_encode as attributes in the onClick function as in your example. — Vlad
– Vlad, Commented Jun 25, 2013 at 8:06
Look, you have two medias in your short code snippet - a JS code and HTML code. Each require different formatting (as explained in the article I linked to) - so, that's why two functions were used. — Your Common Sense
– Your Common Sense, Commented Jun 25, 2013 at 8:16
Have a look at this link en.wikipedia.org/wiki/Unobtrusive_JavaScript . Putting onclick in html and echoing js from php is bad practice — sodhancha
– sodhancha, Commented Jun 25, 2013 at 8:58

Ignacio Vazquez-Abrams · Accepted Answer · 2013-06-25 07:04:27Z

3

Same as always: encode as JSON.

echo '<a onClick="myFunctionTakesPHPValues('.json_encode($element[0]).','.json_encode($element[1]).')">'.$element[2].'</a>';

answered Jun 25, 2013 at 7:04

Ignacio Vazquez-Abrams

804k160 gold badges1.4k silver badges1.4k bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Vlad Over a year ago

This works nicely too, however my string variables come up with quotes now, does that just mean I have too many quotes in there?

Ignacio Vazquez-Abrams Over a year ago

You shouldn't need to add any quotes to the values manually; JSON strings are valid JavaScript literals.

Your Common Sense Over a year ago

It turned out that you actually have to.

Your Common Sense · Accepted Answer · 2013-06-25 08:59:49Z

2

Never echo JS from PHP. Escape from PHP mode instead, it will save you a lot of slashes and nerves.
Every value have to be escaped properly, as explained in this article

So, for the JS values you have to escape them with json_encode() and, as they are going into HTML attribute, escape them as HTML too.
For the last element only HTML encoding is required.

foreach ($array as $element) 
{
    $param1 = htmlspecialchars(json_encode($element[0])); // better give them 
    $param2 = htmlspecialchars(json_encode($element[1])); // meaningful names
    $param3 = htmlspecialchars($element[2]);
?>
<a onClick="myFunctionTakesPHPValues(<?=$param1?>,<?=$param2?>)">
   <?=$param3?>
</a>
<? }

And yes, using raw JS in HTML attributes considered as a bad practice.

edited Jun 25, 2013 at 8:59

answered Jun 25, 2013 at 7:36

Your Common Sense

158k42 gold badges226 silver badges373 bronze badges

Comments

Swapnil · Accepted Answer · 2013-06-25 07:01:15Z

1

Use Like

echo "<a onClick='myFunctionTakesPHPValues(\"".$element[0]."\",\"".$element[1]."\")'>".$element[2]."</a>";

answered Jun 25, 2013 at 7:01

Swapnil

6064 silver badges13 bronze badges

2 Comments

Vlad Over a year ago

Worked like a charm, I was doing my escape slashes the opposite way >_< Cheers to all answers.

Your Common Sense Over a year ago

@Tom actually this is an awfully wrong answer. Making your code insecure

Gimmy · Accepted Answer · 2013-06-25 07:02:43Z

1

Use this:

echo "<a onClick='MyFunctionTakesPHPValues(\"'".$element[0]."','".$element[1]."'\")>'".$element[2]."'</a>'";

answered Jun 25, 2013 at 7:02

Gimmy

3,9192 gold badges21 silver badges28 bronze badges

Comments

TerryA · Accepted Answer · 2013-06-25 07:32:02Z

1

foreach ($array as $element)
{?>
<a onClick="myFunctionTakesPHPValues("<?php echo $element[0].','.$element[1].')>'.$element[2].'</a>'
} 
?>

edited Jun 25, 2013 at 7:32

TerryA

60.2k11 gold badges122 silver badges148 bronze badges

answered Jun 25, 2013 at 7:12

twitch

2251 silver badge13 bronze badges

Collectives™ on Stack Overflow

JS inside PHP Escape String (for functions)

5 Answers 5

3 Comments

Comments

2 Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

5 Answers 5

3 Comments

Comments

2 Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related