php & javascript alert that contains a string with double quote

Question

This is an example of string that should I output in a javascript alert();

string with "double quote" in it

Because this string can be edited via PHP by my users it's better to prevent XSS attacks. To do so in the HTML of my document I usually do:

<?php echo( htmlspecialchars( $MY_STRING, ENT_QUOTES, 'UTF-8' ) ); ?>

That works great.

But now I just noticed that if I output the same string in a javascript alert:

<script>
alert( "<?php echo( htmlspecialchars( $MY_STRING, ENT_QUOTES, 'UTF-8' ) ); ?>" );
</script>

The output of the alert in this case is:

string with "double quote" in it

What is the best way to output the double quotes in a alert, but also preventig XSS injection?

You could put it in a div before alerting: http://stackoverflow.com/a/14937257/1921862 — Fels, Aug 22 '16 at 13:17

score 3 · Accepted Answer · answered Aug 22 '16 at 13:15

3

ENT_NOQUOTES flag ensures all quotes ' and " are not escaped and the addslashes escapes them for the js alert function.

$string = 'string<< with "double quote" in it';
echo htmlentities(addslashes($string), ENT_NOQUOTES);

Output:

string&lt;&lt; with \"double quote\" in it

Keeps your quotes and escapes malicious html tags

answered Aug 22 '16 at 13:15

Roy

3,027
4
29
43

It's a non readable output. the author probably wants: with "double quote" in it: as an output – Franklin Rivero Aug 22 '16 at 13:35
@FranklinRivero Well then he could use ```addcslashes``` instead of ```addslashes``` – Roy Aug 22 '16 at 13:38

score 0 · Answer 2 · answered Aug 22 '16 at 13:16

0

alert( "<?php echo( addslashes( $MY_STRING ) ); ?>" );

Use addslashes() rahter than htmlspecialchars() or combine both. Hope it helps.

addslashes() http://php.net/manual/en/function.addslashes.php

answered Aug 22 '16 at 13:16

Eisa Adil

1,743
11
16

Franklin Rivero · Answer 3 · 2016-08-22T13:22:21.830

0

Everything inside alert is treated like a string and won't be executed, so you won't get an XSS attack if you just make sure it's a singlestring by just escaping the "

For an alert you don't need to use htmlspecialchars, you can just do it like this:

<script>
    alert( "<?php echo addslashes($MY_STRING);  ?>" );
 </script>

edited Aug 22 '16 at 13:22

answered Aug 22 '16 at 13:17

Franklin Rivero

581
1
3
18

2

unless the string is something like: `"); document.location('http://somekinkypornsitewithdonkeys.com'); //` – CD001 Aug 22 '16 at 13:20
Glad you edited the answer to put in `addslashes` ;) – CD001 Aug 22 '16 at 13:25
Yeah, work in progress, writing and testing. BTW I tested it and it works, no XSS there, remove down vote?. – Franklin Rivero Aug 22 '16 at 13:34

php & javascript alert that contains a string with double quote

3 Answers3