syntaxerror unterminated string literal jquery

Question

I get this weird error. It happens to be my PHP code that is embedded into jquery.

<?php $user=isset($_GET['u']) ? $_GET['u'] : NULL; //This returns a numeric value ?> 

<script>
  $("button[name='send_mail']").on('click',function(){
  var user = '<?php echo $user;?>'; // <----The Problem
  $.ajax({
    type:"POST",
    url:"ajax/scripts/user_mail.php?u="+user,
    success: function(data){
        alert(data);
        },
    });
  });
</script>

I tried both, single and double quotes. This piece code happens to work in some of my files and doesn't work in others.

The question is: What's really in `$_GET['u']`? Try `var_dump` in PHP and take a look at the generated JavaScript code. Also you should never pass user input from `$_GET`, `$_POST` etc. directly to the output. — insertusernamehere, Dec 10 '15 at 07:48
definitely as @insertusernamehere said. read more about **XSS**. — Louay Alakkad, Dec 10 '15 at 07:51
@insertusernamehere, my scripts are protected and only someone with a certain session name can run queries on the user id. And, if stack overflow is doing it, I don't there would be a problem — Ikhlak S., Dec 10 '15 at 07:56
`floatval($var);` or `intval($var);` if it is just the user id. — Jan, Dec 10 '15 at 07:58
@insertusernamehere, yeap. When I remove `var user`, everything works fine — Ikhlak S., Dec 10 '15 at 08:00
Are you sure `$_GET['u']` is just an integer? Can you show the generated JavaScript from the source code as what @insertusernamehere has mentioned (i.e. right click, then view source)? — Jia Jian Goi, Dec 10 '15 at 08:06
Can you check the source and add what it is generating on that line? — Sougata Bose, Dec 10 '15 at 08:06
@sougata, I not that good at this and not sure what you really mean. I'm using a jquery.min file and the problem is at `:12:11` — Ikhlak S., Dec 10 '15 at 08:17
I tried your code and it works fine but when the $user has no value, it errors just like yours. — momouu, Dec 10 '15 at 08:23
@user3284463. Right Click on the page -> View Source. Then check that code. — Sougata Bose, Dec 10 '15 at 08:23
Take a look [here](http://stackoverflow.com/questions/7374020/unterminated-string-literal) — Shadow The GPT Wizard, Dec 10 '15 at 08:25
I think I found a way around it but not a solution to this. What I did is returned or echo `$user` to a hidden span and then `var user = $('#user_id_span').text()` — Ikhlak S., Dec 10 '15 at 08:32
try `concat` (http://www.w3schools.com/jsref/jsref_concat_string.asp) it will throw exceptions if it fails for some reason that can help you — online Thomas, Dec 10 '15 at 08:36
Hmm, by chance, does the browser actually show you the above code or is this the php code? The reason I ask may explain your problem. — Neil, Dec 10 '15 at 08:38
@user3284463 That isn't my question. I mean to ask if you see this code *in the browser*. The browser shouldn't show any php tag. — Neil, Dec 10 '15 at 08:40
@neil nope, the browser doesn't show any error. I get this error in the browser developer tools Console — Ikhlak S., Dec 10 '15 at 08:41
Probably because it's impossible to help you without you checking the raw value of that variable, which you keep refusing to do. — Shadow The GPT Wizard, Dec 10 '15 at 11:46

Jan · Answer 1 · 2015-12-10T08:11:28.337

-1

<?php
    $user = (!empty($_GET['u']))?intval($_GET['u']):0;
?>
<script language="JavaScript">
    console.log("User: " + <?php echo $user; ?>);
    // try to debug what is really in the variable
    var user = <?php echo $user; ?>;
    // same as <?= $user; ?>
</script>

edited Dec 10 '15 at 08:11

answered Dec 10 '15 at 08:00

Jan

42,290
8
54
79

@user3284463 Which one exactly? Do you have an error message? – Jan Dec 10 '15 at 08:02
@jan so there is no need to echo it?? – Jai Dec 10 '15 at 08:05
@user3284463 But which one? – Jan Dec 10 '15 at 08:07
@jan `SyntaxError: unterminated string literal` – Ikhlak S. Dec 10 '15 at 08:09
@Jai: `=` is the same as ` – Jan Dec 10 '15 at 08:15
Those lines with `` will only work if `$user` is a number or a boolean. – Cerbrus Dec 10 '15 at 08:15
@Cerbrus True, but the call to `intval()` assures it to actually **BE** it a number, so the code is perfectly fine. – Jan Dec 10 '15 at 08:16
So, what's the output of `intval` if it's parameter _isn't_ a number? – Cerbrus Dec 10 '15 at 08:17
@Cerbrus Admittedly, it throws a warning, but the return value is always an integer (0 or 1 in case of an error). While this is surely just a side issue, consider the following code snippet: http://sandbox.onlinephpfunctions.com/code/f9888486a01186d653ae3c07bacb1b1d1bf234ce – Jan Dec 10 '15 at 08:53
php never fails to... "amaze" me xD – Cerbrus Dec 10 '15 at 08:54

score -1 · Answer 2 · answered Dec 10 '15 at 08:12

-1

You have a rogue comma in this part of your code:

success: function(data){
    alert(data);
    }, //<--- here
});

It should be only:

success: function(data){
    alert(data);
    }
});

answered Dec 10 '15 at 08:12

Shadow The GPT Wizard

66,030
26
140
208

That won't cause any errors. In fact, that's perfectly valid JS. – Cerbrus Dec 10 '15 at 08:12
@shadow Wizard, this is not it – Ikhlak S. Dec 10 '15 at 08:13
@Cerbrus [see here](http://jsfiddle.net/yahavbr/6z9sq722/), though the error is different. (SyntaxError: Unexpected token) – Shadow The GPT Wizard Dec 10 '15 at 08:15
@user3284463 so we can't really know what the problem is, since the part you posted is fine and for some odd reason you refuse to tell us the real value of `$user`. – Shadow The GPT Wizard Dec 10 '15 at 08:16
1

@ShadowWizard: In your example, you're adding a comma in a function call. The stray comma in your answer is just a training comma in an object. that'd different, and perfectly valid JS. – Cerbrus Dec 10 '15 at 08:17
@Cerbrus OK, valid, but ugly in my opinion, so leaving this answer as "better practice advice". – Shadow The GPT Wizard Dec 10 '15 at 08:18
1

Then it doesn't answer the question, and it's an opinion-based answer. – Cerbrus Dec 10 '15 at 08:19
@Cerbrus feel free to downvote and flag. Have a good day, thanks. – Shadow The GPT Wizard Dec 10 '15 at 08:20
@ShadowWizard, I have mentioned it is just an numeric value, a user ID. – Ikhlak S. Dec 10 '15 at 08:21

score -1 · Accepted Answer · answered Dec 10 '15 at 09:09

This works:

<?php $user=isset($_GET['u']) ? $_GET['u'] : NULL;?>
<span id="user_id_span" style="display:none;"><?php echo $user; ?></span>

<script> 
  var user = $('#user_id_span').text();
</script>

If your output is more than just a single string or number or single line, this would not work.

syntaxerror unterminated string literal jquery

3 Answers3