escaping - How can I properly escape JavaScript in JavaScript? -


It can be something that I can not ... but

  parent .documentation .getElementById ('& lt ;? php echo $ _GET [' song '];; & gt;') WinnerHTML = '& lt; Img src = "heart.png" onmouseover = "Heartwort ('');" & Gt; ';  

onmouseover = "heart over (''); The part breaks my javascript. Is there a way to avoid quotes, so that I can do that?

Avoid nested quotes with a backslash: \ '

In addition, the never user data will be able to echo it or without sneaking:

  $ song = $ _GET ['song']; // Valid HTML ID (http: // www .w3.org / TR / REC-html40 / types.html # type-name) if (! Preg_match ('/ ^ [az] [- a-z0-9 _ :.] * $ / ', $ C {// display error because $ song is invalid}  

OR

  // save $ song = preg_replace ('/ (^ [^ Az] * | [^ -a-0-9 _:.]] / ',' ', $ Song);  

Comments

Popular posts from this blog

c# - ListView onScroll event -

PHP - get image from byte array -

Linux Terminal Problem with Non-Canonical Terminal I/O app -