Sanitizing data to use within quotes & within URL

Question

If I want to put a value between single quotes in Javascript how can I sanitize/encode it so that any quotes in the value doesn't cause issues?

I also want to then use this value in a query string which I will then be passing to PHP.

Whatever is used I need to be able to decode it back to it's normal value with PHP.

Example:

$foo = "Hey, what's up!?"; // PHP

getGrades('<?=$foo?>'); // JS Function

function getGrades(var) {

        // Set file to get results from..
        var loadUrl = "ajax_files/get_grades.php";

        // Set data string
        var dataString = 'grade=' + var;

        // Run the AJAX request
        runAjax(loadUrl, dataString);          

}

function runAjax(loadUrl, dataString) {

    jQuery.ajax({
        type: 'GET',
        url: loadUrl,
        data: dataString,
        dataType: 'html',
        error: ajaxError,
        success: function(response) {
            someFunction(response);
        }
    });    

}

// get_grades.php file

$grade = $_GET['grade']; // We now want this value to be it's normal value of "Hey, what's up!?";

duplicate : http://stackoverflow.com/questions/75980/best-practice-escape-or-encodeuri-encodeuricomponent http://stackoverflow.com/questions/332872/how-to-encode-a-url-in-javascript — Jerome Cance, Jan 08 '13 at 10:57
Use Quentin response and change the var `var` because it's reserved. — Mihai Iorga, Jan 08 '13 at 11:09

Shiplu Mokaddim · Answer 1 · 2013-01-08T11:17:48.983

1

If you have concatenating with single quoted string it will not be an issue. Only thing left is when you use it in query string. In that case You should use encodeURIComponent.

Also change your var to something else. var is a keyword in JavaScript.

edited Jan 08 '13 at 11:17

answered Jan 08 '13 at 10:55

Shiplu Mokaddim

56,364
17
141
187

1

@Brett — Nothing. PHP will decode it before populating `$_GET`. – Quentin Jan 08 '13 at 11:06

score 1 · Accepted Answer · answered Jan 08 '13 at 11:06

1

getGrades('<?=$foo?>'); // JS Function

json_encode will make a string JavaScript safe (and quote it).

getGrades(<?php echo json_encode($foo); ?>);

I also want to then use this value in a query string which I will then be passing to PHP.

Pass data: an object, not a string. jQuery will handle the escaping for you.

var dataString = { grade: var }; // Rename the variable too

answered Jan 08 '13 at 11:06

Quentin

914,110
126
1,211
1,335

`var` was cribbed from the original code. Hopefully it is just a poor example. – Quentin Jan 08 '13 at 11:10
Btw... I won't need to do any decoding with PHP once I get the variable from the query string right!? – Brett Jan 08 '13 at 11:12
Assuming you use `$_GET` to do so. – Quentin Jan 08 '13 at 11:14

Sanitizing data to use within quotes & within URL

2 Answers2