0

I have a Bootstrap Datatable with cells containing buttons. Each button have several data-* attributes. When clicking on a button, a modal dialog is shown, and the content of the modal is based upon the data-* attributes, as in the minimal example below.

The table is created in a PHP file and sent back to a function in jQuery via an Ajax request. The table content is updated simply by replacing its current content with the data coming from the PHP file.

All works well, except for the fact that I am unable to initialize the data-* attributes properly, since they are set to values coming from a database and may or may not contain quotes, apostrophes, etc.

So, here is my simplified code.

update_table.php

// Here a new cell is created
$cell = $cell . "<button type='button' class='btn btn-warning btn-sm' 
                   data-toggle='modal' data-target='#booking-edit-modal' 
                   data-id='$booking_id'
                   data-employee='$booking_employee_name' 
                   data-plate='$booking_plate' 
                   data-date='" . fetch_date('d-m-Y', $booking_date) . "'
                   data-starting-location='$booking_starting_location'
                   data-start-time='$booking_start_time'
                   data-ending-location='$booking_ending_location'
                   data-end-time='$booking_end_time'
                   data-service='$booking_service'
                   data-reason='$booking_reason'>
                   $booking_employee_name (" . fetch_date('H:i', $booking_start_time) . "-" . fetch_date('H:i', $booking_end_time) . ")
                 </button><br/>";

Each variable whose name starts with booking_ represents an attribute of an entry in a table of my database. So, booking_reason represents the attribute reason of a certain booking entry in the Bookings table. If it contains an apostrophe or quotes, only the substring up to and not including the apostrophe or quotes is sent back through the Ajax request.

Michael
  • 876
  • 9
  • 29
  • If you can avoid outputting HTML with PHP, you should, every time. – GrumpyCrouton Dec 05 '17 at 13:58
  • Oh, it looks like htmlspecialchars($booking['reason'], ENT_QUOTES, 'UTF-8') solved the issue. I tried it before, but without the additional parameters. Well, what is the alternative way to achieve this without using PHP to create the HTML code? – Michael Dec 05 '17 at 14:00

0 Answers0