escaping - How can I properly escape JavaScript in JavaScript? -
It can be something that I can not ... but
parent .documentation .getElementById ('& lt ;? php echo $ _GET [' song '];; & gt;') WinnerHTML = '& lt; Img src = "heart.png" onmouseover = "Heartwort ('');" & Gt; ';
onmouseover = "heart over ('');
The part breaks my javascript. Is there a way to avoid quotes, so that I can do that?
Avoid nested quotes with a backslash: \ '
In addition, the never user data will be able to echo it or without sneaking:
$ song = $ _GET ['song']; // Valid HTML ID (http: // www .w3.org / TR / REC-html40 / types.html # type-name) if (! Preg_match ('/ ^ [az] [- a-z0-9 _ :.] * $ / ', $ C {// display error because $ song is invalid}
OR
// save $ song = preg_replace ('/ (^ [^ Az] * | [^ -a-0-9 _:.]] / ',' ', $ Song);
Comments
Post a Comment