Injecting PHP data into JavaScript code

Question

What's the preferred way of outputting PHP code within apostrophes? For example this JavaScript code would break and the second line will be totally empty:

var jsString = '<div id="content">'+'<?php echo $something['1'] ?>'+'</div>';

Thanks! I know this is kind of basic and I know how to fix it, but I'm wondering how to do it the right way?

[edit]

I know it looks obvious, but $something["1"] won't work. The same goes for $something[\'1\'].

PHP doesn't interpret anything outside the `` tags, so the Javascript stuff is irrelevant. — Oliver Charlesworth, Sep 11 '13 at 23:14
I think this should have been tagged with javascript and not PHP. — Lix, Sep 11 '13 at 23:14
@Lix not really, because this has nothing to do with javascript (other than the fact that he's using js in his example). — kennypu, Sep 11 '13 at 23:15
@ken **The OP wants to know how to correctly escape a string in JS.** The fact that the string that needs to be escaped is PHP is irrelevant. The same question could be asked about printing python or C# in JavaScript. The programming language being used is JavaScript. — Lix, Sep 11 '13 at 23:16
It might help to tell us what you are trying to accomplish. Are you trying to store a string that will later be executed by PHP? Or are you trying to add a PHP value to a javascript string? — showdev, Sep 11 '13 at 23:17
Are you trying to output the results of the PHP code, or are you trying to literally include the text ` — , Sep 11 '13 at 23:17
@Lix: That's the case if the OP is trying to emit PHP code with JS. That's possible, but unlikely. At the very least, the OP needs to clarify ;) — Oliver Charlesworth, Sep 11 '13 at 23:18
I'm storing a WordPress option (plain text within a variable) and want to output it to the front-end, as a text too :) The JS generates a dynamic box and it should contain text you set on the back-end. — Wordpressor, Sep 11 '13 at 23:18
This is unanswerable if you're not just going to reject `$something[\'1\']` out of hand without telling us why it won't work. — user229044, Sep 11 '13 at 23:18
Not sure I understand. Are you asking how to do this : `''`, or this: `$something['1']`? — Jordan, Sep 11 '13 at 23:18
@Lix no, the question is in summarization: "why isn't `` not working?" the example can easily be something like `
'>` and it would be the same question. — kennypu, Sep 11 '13 at 23:18
We need to know more about what he's doing. Is he trying to inject PHP code into the javascript that gets read by the browser (e. g. inserting a value for javascript to then read later), or is he trying to inject a string into javascript that happens to be PHP? — RonLugge, Sep 11 '13 at 23:20
meagar, with `\'1\'` I'm getting this error: `Parse error: syntax error, unexpected ''1\']; ?>'' (T_CONSTANT_ENCAPSED_STRING), expecting identifier (T_STRING) in (...)` — Wordpressor, Sep 11 '13 at 23:21
RonLugge, I'm tryng to inject a a string into JS and this string happens to be PHP. — Wordpressor, Sep 11 '13 at 23:22

score 6 · Accepted Answer · answered Sep 11 '13 at 23:24

6

This example is working well for me :

<?php
$something['1']='hhhh0';
 ?>
<script type='text/javascript'>
var jsString = '<div id="content">'+'<?php echo $something['1'] ;?>'+'</div>';
    alert(jsString);
</script>

answered Sep 11 '13 at 23:24

Charaf JRA

8,249
1
34
44

I think I've found what the problem was, and it had nothing to do with apostrophes after all. Try storing line breaks in $something['1']. Does it work too? Even json_encode() won't help as there are some HTML tags in there. Ugh. – Wordpressor Sep 11 '13 at 23:26
@Wordpressor What does your actual data look like? I tried this solution with a line break and HTML tags and it seemed to work: http://phpfiddle.org/main/code/j19-vvc – showdev Sep 11 '13 at 23:42
@showdev, I think I'm going to ask another question, my data comes from a textarea and user inputs it, it can contain any HTML tags, so it might be, for example: `
A header
` [user hits enter here for the next line] `
something else
` [another enter for new line] etc. I guess all I need to do is to replace every new line with `'+` although it doesn't seem to be an easy thing to do. – Wordpressor Sep 11 '13 at 23:42
@Wordpressor i suggest to user `strip_tags()` function in php to eliminate every tag in the post variable , pay attention to injections and xss attacks – Charaf JRA Sep 11 '13 at 23:46
@FaceOfJock, what if I want the tags there? I guess it will take a lot of effort to accomplish? – Wordpressor Sep 11 '13 at 23:50
@no problem this example is working with tags , i tought you want to display those tags in alert :P , sorry :) – Charaf JRA Sep 12 '13 at 08:19

Injecting PHP data into JavaScript code

1 Answers1

A header