CODEWITHSUNDEEP
phpjavascriptjqueryajaxescaping
TaylorMac
TaylorMac

Reputation: 9002

How to escape Javascript code that is echoed in PHP

I have this code that is captured in the jquery Data object from a php page.

echo "
    var $d = $('<div/>', {
        id: 'hi' + $('#textResp').children().length,
        class: 'eventdiv',
        html: 'hello'
    }).hide().fadeIn(3000);

    $('#textResp').append($d)

";

Problem is, the 's are not escaped. I have tried using /' to escape, but it comes up with an error. I am sure I am doing this wrong, does anyone know where to put the /' instead of '?

Upvotes: 2

Views: 4453

Answers (6)

cainanyang
cainanyang

Reputation: 199

use json_encode function in php, it behaves like the escape_javascript function in rails.

just pass a string argument to the json_encode function, and it return the escaped string for you, see the sample code below:

<?php
$form_html  = <<HTML
<form action='...' ...>
    <input type='...' name='...' ...>
    ...
</html>
HTML;
?>

var form_html = <?php echo json_encode($form_html); ?>;
$('.remote#create_form').html(form_html).slideDown();

Upvotes: 1

Asaph
Asaph

Reputation: 162771

Your apostrophes actually look fine. But, within a double quoted string, PHP will evaluate any string beginning with a dollar sign as a variable and not produce the desired result. Try replace the jquery related instances of $ with \$. Like this:

echo "
    var \$d = \$('<div/>', {
        id: 'hi' + \$('#textResp').children().length,
        class: 'eventdiv',
        html: 'hello'
    }).hide().fadeIn(3000);

    \$('#textResp').append(\$d)

";

Upvotes: 1

pthurlow
pthurlow

Reputation: 1111

You could use a php nowdoc instead of quotes at all which would simplify things:

echo <<<'DOC'
    var $d = $('<div/>', {
        id: 'hi' + $('#textResp').children().length,
        class: 'eventdiv',
        html: 'hello'
    }).hide().fadeIn(3000);

    $('#textResp').append($d)
DOC;

then use whatever you want inside (quote or dquote). This is, of course, unparsed so if $d was actually referring to a php var then you would have problems.

Upvotes: 4

Kevin Vaughan
Kevin Vaughan

Reputation: 15170

Use single quotes for your string construction. Only use double quotes when you specifically are including variables that you want evaluated. PHP is trying to evaluate all of those $ references you have in there. By using single quotes, you will avoid many escaping problems.

echo '
    var $d = $("<div/>", {
        id: "hi" + $("#textResp").children().length,
        class: "eventdiv",
        html: "hello"
    }).hide().fadeIn(3000);

    $("#textResp").append($d)

';

Upvotes: -1

freeatnet
freeatnet

Reputation: 104

PHP will attempt to expand variables, $name, that occur in strings wrapped in double quotes. Since $d looks like a variable to the PHP interpreter, it will try to replace it with the variable's value.

Assuming that you don't have $d defined anywhere, that will produce an empty space and, possibly, a notice (if you are using error level E_NOTICE).

To prevent that from happening, escape dollar signs with a backslash (replace $ with \$)

Upvotes: -1

GONeale
GONeale

Reputation: 26494

You will need to use \ before all 's.

However, this is puzzling, why do you feel you need escape characters? It appears you are simply echoing this output, if this is between <script /> tags, you should be fine.

Upvotes: -1

Related Questions