Escaping quotation marks in PHP for JavaScript function argument

Question

I'm having trouble escaping a quotation mark in PHP. I have a table of products and each row has an onclick function, with the name of the product as the argument.

The name contains the length which is measured in inches, so the name contains a quotation mark. I wrapped an addslashes() around the string. This adds a backslash before the quotation mark but for some reason it doesn't seem to escape the character!

Here's a snippet of my code:

<?$desc1 = addslashes($row['Desc1']);?>

<tr class='tableRow' onclick='afterProductSelection("<?=$desc1?>")'>

<td><?=$row['Desc1']?></td>

When I inspect element in Google Chrome, the colour of the syntax indicates that this has not been escaped, clicking on it gives me a syntax error.

enter image description here

Probably something simple that I'm missing. Hope you can help!

Spudley · Accepted Answer · 2014-01-08 16:05:57Z

4

There are a lot of different cases where you need to escape a string. addslashes() is the wrong answer to pretty much all of them.

The addslashes() function is an obsolete hang-over from PHP's early days; it is not suitable for any escaping. Don't use it. Ever. For anything.

In your particular case, since you're creating Javascript data from PHP, use json_encode().

json_encode() will take a PHP variable (whether it's a string, array, object or whatever) and convert it into a JSON string. A JSON string is basically fully escaped Javascript variable, including the quotes around your strings, etc. This is what you need to do.

answered Jan 8, 2014 at 16:05

Spudley

169k39 gold badges240 silver badges309 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Álvaro González Over a year ago

I've +1ed for the addslashes() part, even before reading the rest :)

Community · Accepted Answer · 2023-11-17 19:20:55Z

2

The addslashes() function is an obsolete hang-over from PHP's early days; it is not suitable for any escaping. Don't use it. Ever. For anything. -Spudley

I think the function you're looking for is htmlentities()

<?=htmlentities($desc1, ENT_QUOTES)?>

https://www.php.net/htmlentities

edited Nov 17, 2023 at 19:20

CommunityBot

11 silver badge

answered Jan 8, 2014 at 15:59

MrHunter

1,8901 gold badge15 silver badges23 bronze badges

2 Comments

Dan Johnson Over a year ago

Thanks! Easiest answer to implement and perfect results :)

Álvaro González Over a year ago

This answer contains correct information but is incomplete. Using addslashes() to generate JavaScript strings is wrong and will break your page randomly.

Álvaro González · Accepted Answer · 2014-01-08 15:59:17Z

2

You are generating a JavaScript string encoded as HTML so you need to encode twice:

Use json_encode() to generate the string
Use htmlspecialchars() to encode as HTML

answered Jan 8, 2014 at 15:59

Álvaro González

147k45 gold badges282 silver badges378 bronze badges

Comments

VisioN · Accepted Answer · 2014-01-08 16:00:40Z

2

Use json_encode to output variables from the backend in JavaScript:

<tr onclick='afterProductSelection(<? print json_encode($desc1); ?>)'>

N.B.: For string output there is no need for extra quotes.

answered Jan 8, 2014 at 16:00

VisioN

146k35 gold badges287 silver badges291 bronze badges

Collectives™ on Stack Overflow

Escaping quotation marks in PHP for JavaScript function argument

4 Answers 4

1 Comment

2 Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

1 Comment

2 Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related