0

I have the following situation: A PHP script loads entries (HTML encoded) from a database and simply lists them in a list ... nothing wild so far.

I have however, appended an image on each <li> tag, which has an onClick event to a JavaScript function defined. And this is the problem.

A "normal" list would look like:

<li>This is a picture ... <img src="../../png/edit.png" alt="edit" onClick="edit('edit','<description of the thing>'")

But now I have noticed that some people do like to tag something in the way of:

This is my daughter's first birthday

and this in turn gets encoded to:

<li>This is a picture ... <img src="../../png/edit.png" alt="edit" onClick="edit('edit','This is my daughter's first birthday'")

The ' character gets displayed in the source correctly as &#039; and the browser does interpret it correctly as '.

When it comes to calling a function, the arguments are split up and one more ' is missing to actually have a valid argument.

Any way around this?

That code above with the pictures is just a simpler example of what is happening, but the user should be able to edit the text that is being displayed, and this text is being loaded currently when the PHP script generates the page and passes the "text" as a variable into the function.

Not the best way, just figured that one out myself, but too late now. :(

Sebastian Zartner
  • 18,808
  • 10
  • 90
  • 132
Flo draven
  • 85
  • 4
  • Think you need to change `onClick="edit('edit',''")` because the closing parentheses are after the closing of the onClick function. But that may be because you just quickly entered a piece of example code? – Simon Feb 15 '15 at 23:14
  • And always, always, always sanitize user input. Always. – Simon Feb 15 '15 at 23:16
  • This is somewhat hackish, but you can convert the single quote `'` (or the HTML entity) of the string (i.e. using `str_replace()`) to a curly quote `’`, and then it won't interfere with your code. Without seeing your setup that's the best advice I can offer – Brock Amhurst Feb 15 '15 at 23:28

0 Answers0