1

There are many questions about escaping single and double quotes but I have had no luck finding an answer that solves my particular problem.

I have a PHP function that dynamically returns an image with an onClick event that calls a Javascript function with the name of an object as an argument like so:

$response = "<img src=\"images/action_delete.gif\" onClick=\"confirmDelete("'" . $event->getName() . "'")\"/>"";

The Javascript function should display a confirmation dialogue at some point like this:

confirm('Delete event ' + name + ' ?')

How should I format $response in PHP to make sure the Javascript confirm won't mess up when the user enters a name containing ' or " or \' or \" ?

4 Answers 4

8

You could escape any quotes in php using htmlspecialchars or htmlentities, however this doesn't solve the issue of single quotes, even if ENT_QUOTES is set.

Doing a little testing I see the following should work, although it may not be very elegant:

$name = htmlentities(str_replace("'", "\'", $event->getName()));
$response = "<img src=\"images/action_delete.gif\" onClick=\"confirmDelete('" . $name . "')\"/>";

Hope that helps

5
  • I expanded your code a bit. htmlentities(str_replace("'", "\'",str_replace("\'","\\\'",$input)));so the dialogue actually shows \' if the user entered \'. I'm not sure how to do the same for \" but at least this prevents the confirm dialogue from messing up. Thanks for the suggestion.
    – EENN
    Commented Apr 13, 2011 at 10:48
  • Ah, I didn't think about user's entering escaped quotes. The following should take care of all 4 cases, and also combines it all into 1 str_replace() call. You probably dont need the htmlentities() call if you're also escaping the " chars, but it may be handy to handle & and other special chars. try: str_replace(array("\'", '\"', '"', "'"), array("'", '"', '\"', "\'"), $input);
    – nicja
    Commented Apr 13, 2011 at 11:01
  • Wouldn't replacing "\'" with "'" and then "'" by "\'" just switch the problem around ? Or does the function not work in that way ? Perhaps my question wasn't entirely clear. I don't want to sanitize the input in a traditional sense, I actually want the alert to display what the user entered exactly as they entered it. I'm particularly having a hard time replacing both the backslash and double quote in \" so I can pass it to javascript exactly like that.
    – EENN
    Commented Apr 13, 2011 at 13:10
  • 1
    htmlentities(str_replace(array("\'", '\"', '"', "'"), array("\\\'", '\\"', '\"', "\'"), $input)); Seems to accomplish what I am trying to do, though I can't really explain why the htmlentities makes a difference.
    – EENN
    Commented Apr 13, 2011 at 13:16
  • Any reason why you can't just use the addslashes() function?
    – Matt K
    Commented Aug 16, 2016 at 16:50
2

Process the string using json_encode(). That will ensure it's a valid JavaScript expression.

1
  • Is there anything wrong with the way in which I've used and escaped quotes in my example that would cause this not the work when simply applied to the $event->getName() ?
    – EENN
    Commented Apr 13, 2011 at 10:13
2

Very safe alternative which also gives you the hand cursor for free

<script> 
function confirmDelete(idx) {
  if (confirm(document.getElementById("msg"+idx).innerHTML)) {
    location="delete.php?idx="+idx;   
  }   
  return false 
}
<span id="msg1" style="display:none"><?PHP echo $event->getName(); ?></span> 
<a href="#" onClick="return confirmDelete(1)"><img src="images/action_delete.gif" style="border:0" /></a>
1
  • Thank you for the suggestion ! This looks like something I might use in the future but I'm afraid it requires too drastic of a rewrite in my current situation. I was hoping to use some kind of function to simply escape those 4 character(combinations) like the json_encode() ThiefMaster suggested.
    – EENN
    Commented Apr 13, 2011 at 10:01
0

Another solution worked for me, if you have single quotes, double quotes, slashs and backslashes in your input string :

$output = htmlentities(str_replace(array(chr(92), "'"), array(chr(92) . chr(92), "\'"), $input));

with something like :

 onClick=\"confirmDelete('" . $output . "')\"

Thanks to nicja !

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.