How to encode a URL as javascript string in PHP-generated HTML?

Question

Given this PHP code:

<a onclick="javascript:window.location.href='<?php echo $url;?>'"

What if there is a ' in $url?

I tried using json_encode($url) but it won't be able to handle this.

Why do you use this <a onclick="javascript:window.location.href=…" anyways? Why not simply <a href="…"? — Gumbo
– Gumbo, Commented Oct 6, 2009 at 17:25
If the user doesn't have JS enabled and you don't set an href, it won't go anywhere FYI. — meder omuraliev
– meder omuraliev, Commented Oct 6, 2009 at 17:30
Because this is a contrived example.I am using it on div actually. — Misier
– Misier, Commented Oct 6, 2009 at 17:32
It looks like hardcode,is there a more elegant way to do it? — Misier
– Misier, Commented Oct 6, 2009 at 19:20

Gumbo · Accepted Answer · 2009-10-06 17:22:39Z

3

json_encode will work. You just have to use it the right way:

<a onclick="javascript:window.location.href=<?php echo htmlspecialchars(json_encode($url)); ?>">

This will work since json_encode already returns an JavaScript expression with quotes. And htmlspecialchars is needed to escape possible HTML meta characters.

answered Oct 6, 2009 at 17:22

Gumbo

657k112 gold badges792 silver badges852 bronze badges

Sign up to request clarification or add additional context in comments.

13 Comments

Gumbo Over a year ago

@meder: Don’t ask me, ask the OP.

bobince Over a year ago

htmlspecialchars will encode the inner double-quotes to ", so it'll be fine. Also, can we lose the pointless ‘javascript:’ label?

Gumbo Over a year ago

As bobince already said, the htmlspecialchars function will encode double quotes with ". And " inside a attribute value is legal and will be interpreted as a double quote character. So title=""foo"" will be evaluated to the attribute value "foo" (with double quotes).

Kip Over a year ago

@Gumbo: no, the problem is that json_encode('abc') returns "abc" (including the quote characters). htmlspecialchars then encodes that as "abc", but the problem is that he doesn't want the quotes there in the first place.

Gumbo Over a year ago

@Misier: The " inside the attribute declaration is interpreted as ". Just like any other character reference is interpreted as the character it represents. “Some authors use the character entity reference """ to encode instances of the double quote mark (") since that character may be used to delimit attribute values.” (See w3.org/TR/html4/charset.html#h-5.3) And the attribute declaration "location.href="…"" is interpreted as location.href="…".

|

Collectives™ on Stack Overflow

How to encode a URL as javascript string in PHP-generated HTML?

1 Answer 1

13 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

13 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related