Escaping a String

#native_company# #native_desc#

#native_cta#

This site is best viewed in a modern browser with JavaScript enabled.

kbc1

Hi all

I have this pesky bug in my system and i'll try to explain it briefly.

I pull out data from the database and via PHP/HTML output a list of user accounts.

In some cases some of the data in the customer account contains a single quote, e.g:

Mr Joe Bloggs
12 My Street's Name
My Town
My City

Now I run a javascript function via the onclick event of that HTML table row in my page and I pass the customer details to another script. This is my function (broken down for simplicity) from the HTML page:

onclick='useContactDetails("<?php echo mysql_real_escape_string($firstname); ?>","<?php echo mysql_real_escape_string($lastname); ?>","<?php echo mysql_real_escape_string($row['address1']); ?>");'

Now this breaks my javascript and the error console message I get is as follows:

Error: SyntaxError: unterminated string literal
Source Code:
useContactDetails("Mr","Joe","Bloggs","12 My Street\

How can I get around this problem?

Many Thanks for reading.

Kris

007Julien

Replace, in your database, all single quote by a ' or a typographic apostrophe ( [FONT=serif]’[/FONT] ), also known as the typset apostrophe, or, informally, the curly apostrophe obtain with alt 0146.

Sup3rkirby

First, I'll play you this old broken record that says you shouldn't be using the old 'mysql' commands in PHP as they are far less secure than more recent implementations (eg. mysqli or PDO) and all of those functions were removed from PHP as of version 5.5 (thus your script breaks when/if your server updates it's version of PHP).

[EDIT]
Upon further review (of the simplicity of this problem), I've boiled down the answer to be as simple as possible.
Start using urlencode() (and urldecode() respectively) when passing strings through PHP to MySQL and back. Using urlencode() before putting a string into a javascript variable will prevent your issue. And when you need to decode this string you can simply use the unescape() function in javascript to display a normal version of your string.

waqas850

Replace the code to escape it.

deathshadow

uhm... why are you using mysql_real_escape_string for your HTML OUTPUT? That doesn't even make sense! (of course since this is 2014 not 2004, why are you using mysql_ functions in the first place?!?)

If it's output in a html attribute, you should be using htmlspecialchars, NOT mysql_real_escape_too_blasted_long_a_name....

http://docs.php.net/manual/en/function.htmlspecialchars.php

NOT that using the onevent attributes is all that great an idea anymore either. Good scripting should hook existing elements, not be static code in the middle of the markup... just as a well written page should be made to work without scripting FIRST.