Concat String and php Variable when appending in html - php

I have used below code:
$html = '';
$html. = '<br></br>';
$html .= 'Next 50 ';
but my PHP variables are not recognized.

Difference between Double quotes and single quotes
According to this Stackoverflow answer:
Single quoted strings will display things almost completely "as is." Variables and most escape sequences will not be interpreted. The exception is that to display a literal single quote, you can escape it with a back slash \', and to display a back slash, you can escape it with another backslash \\ (So yes, even single quoted strings are parsed).
Double quote strings will display a host of escaped characters (including some regexes), and variables in the strings will be evaluated. An important point here is that you can use curly braces to isolate the name of the variable you want evaluated. For example let's say you have the variable $type and you what to echo "The $types are" That will look for the variable $types. To get around this use echo "The {$type}s are" You can put the left brace before or after the dollar sign. Take a look at string parsing to see how to use array variables and such.
Solution
They are not recognized, because you have put all your string in single quotes (').
You should replace them all with double quotes (").
$html = "";
$html. = "<br></br>";
$html .= "Next 50";
Another solution
Also you have the option of separating your variables from text:
$html = '';
$html. = '<br></br>';
$html .= 'Next 50';
Yet another solution
If you don't want to escape so many double quotes, you may use single quotes instead:
$html = "";
$html. = "<br></br>";
$html .= "<a href='javascript:void(0)' class='test' onclick='get_data(\"$access_token\",1,\"$marketTagId\");'>Next 50</a>";

Try this, it might help you
<?php
$html = '';
$html. = '<br></br>';
$html .= 'Next 50';
?>

Try this
get_data('".$access_token."',1,'".$marketTagId."');
Or
get_data(<?php $access_token ?>,1,<?php $marketTagId ?> );

You need to write '' around your PHP variables otherwise in onclick function they will not worked.
Use below code:-
$html = '';
$html. = '<br></br>';
$html .= "Next 50 ";
Hope it will help you :)

Use the php variables within { and }
$access_token = "1234567890ABCDEFGHIJKLMNOPQRSTUVWXYZ";
$marketTagId = "__AAA__B_123";
$html = "";
$html .= "<br></br>";
$html .= "Next 50";
echo htmlentities($html);

your code:
$html. = '<br></br>';
$html .= '<a href= "
change to this:
$html.= '<br></br>';
$html.= '<a href= "
try this:
$html = '';
$html.= '<br></br>';
$html.= 'Next 50 ';
can you expect this:

Hi All Thanks for helping.
This is worked for me :
$html .= '</table>';
$html .= '<br><br>';
$html .= '<a href= "javascript:void(0)" class= "test" onclick= \'get_data("'.$access_token.'","1","'.$marketTagId.'");\'>Next 50 </a>';

Related

Escape string with PHP and HTML

I have these two lines that I would like to escape the $type variable:
$functionName = str_replace('-', '_', $type);
$output .= '<div class="tab-pane" id="'. $type .'">';
I tried escaping like below but its confusing me and not sure whether thats right:
$output .= '<div class="tab-pane" id="\'. $type .'\">';
Example 1: Variable between single quotes
If you use single quotes everything between them will always be treated as part of the string.
$output .= '<div class="tab-pane" id="' . $type . '">";
Example 2: Variable between double quotes (option 1)
If you have a variable that you want to pass in a string you can just put it in there if you use double quotes and de variable is nog 'touching' the other words. It should always have spaces.
$output .= "<p>i would like to $your_text_here with you.</p>";
Example 3: Escaping quotes in a string
Escaping characters in a string can be done by using a \ (backslash) before the character you want to escape.
$output .= "<div class=\"tab-pane\" id=\"example-id\">";
Example 4: Variable between double quotes without spaces next to it
You can place your variable between {} braces if you use double quotes (option 2)
$output .= "<div class=\"tab-pane\" id=\"{$type}\">";
This question was however already answered in Mixing PHP variable with string literal
Your first block is doing string replacements, but then you use the ORIGINAL string, not the replaced one:
$output .= '<div class="tab-pane" id="' . $functionName . '">';
would be more correct. On the second one, you're escaping the ' quotes, which means that you never terminate the string, meaning that the . $type . portion is treated as plaintext within the string, not a PHP concatenation operation. Try
$output .= '<div class="tab-pane" id="' . $type . '">';
instead. note the LACK of backslash escapes.
And of course, you could use a HEREDOC, eliminating any need to escape quotes entirely:
$output .= <<<EOL
<div class="tab-pane" id="{$functioName}">
EOL;
In this case, you don't need to escape at all. You only escape within the same type of quotes. You don't escape double inside single or single inside double.
So with 'o'reilly' you would escape like 'o\'reily'. But with "o'reilly" you'd just keep it as "o'reilly". But with "He said "hello"" you'd escape "He said \"hello\"". Yet, with 'He said "hello"' you would not escape at all.
But if your $type variable can contain double quotes, you will need to consider that to prevent your HTML from being broken in that case. How you would handle the quotes inside the variable $type would be by replacing the " with its HTML entity equivalent:
$output .= '<div class="tab-pane" id="' . str_replace('"', '"', $type) . '">';
Or use htmlentities() which will do the same replace as well as others.
Note, its the double quotes inside the variable you would want to handle, not to escape the single quotes outside. Because presumably the issue is that if the variable contained double quotes it would break your HTML since you are using double quotes around the value for id:
i.e. id="contents_of_type_variable"
If you had id="contents"_of_type_variable" your HTML would be broken.
So you change that to id="contents"_of_type_variable"
If you're trying to escape something else, it is due to a misunderstanding.

Rendered PHP Variable outside of the img src element, need escaping advice

Hey guys, I have the following code:
foreach($collection as $img)
{
$image_id = $img['imageid'];
$thumbwidget = wp_get_attachment_image_src($image_id, 'full');
$gallery .= '<a class="fav-image-a" href="http://www.bangstyle.com/haircut-detail/?uid='.$uid.'&img_id='.$image_id.'&ucolid='.$user_id.'&catid='.$col_id.'&theater">';
$gallery .= '<img src="';
$gallery .= thumbGen($thumbwidget[0],259,320,'valing=top');
$gallery .= '">';
$gallery .= '</a>';
}
I think I may have the wrong order of escaping. The rendered variable is not staying within the img src when rendered. I assume it has to do with my escaping somewhere.
The live url can be seen at http://bangstyle.com/test-widget/
You can see what's happening. The rendered elements are on top.
Why the extra quotes inside? What you are producing is this:
<img src="'THUMBWIDGETURL_IS_INSERTED_HERE'">
What you probably want is this:
<img src="THUMBWIDGETURL_IS_INSERTED_HERE">
To do that just remove the extra \':
$gallery .= '<img src="'.$thumbwidgeturl.'">';
Rules to be aware of:
In PHP, both single quotes and double quotes can be used to produce string literals.
Each should be used in a pair and that pair constitutes one string literal. So, in your example you have two string literals and a variable being combined (concatenated) with the dot (.) operator.
Inside single quotes, single quotes need to be escaped, and inside double quotes, double quotes need to be escape. The other type of quotes in each can be used freely without escaping.
Strings inside single quotes are taken as they are, while strings inside double quotes are interpreted for variables.
More information in the PHP docs on Strings.
How about this:
$gallery .= "<img src=\"" . $thumbwidgeturl . "\">";
or even:
$gallery .= '<img src="' . $thumbwidgeturl . '">';

Multiple layers of quotes in script in PHP variable that is echoed

PHP:
$var123 = '<div class="mydiv" onclick="document.getElementById("dialog").style.display = "block";">Some text</div>';
echo($var123);
I know this is a total newbie question, but how do I make this work? Thanks!
You can use single quotes in Javascript. Since your string is enclosed in single quotes you also need to escape them in PHP with a backslash \.
$var123 = '<div class="mydiv" onclick="document.getElementById(\'dialog\').style.display = \'block\';">Some text</div>';
echo $var123;
$var123 = 'Some text';
<div class="mydiv" onclick="document.getElementById("dialog").style.display = "block";">
<?php echo $var123; ?>
</div>;
Try this

passing php variable in onClick function

I want to pass the php variable value in onClick function.
When i pass the php variable, in the UI i am getting the variable itself instead I need the value in the variable.
Below is code snippet, please help me.
<?php
print '<td>';
$node = $name->item(0)->nodeValue;
$insert= "cubicle"."$node<br>";
Echo '<a href= "#" onClick= showDetails("$node");>'. $insert .'</a> ';
print '</td>';
?>
Variable parsing is only done in double quoted strings. You can use string concatenation or, what I find more readable, printf [docs]:
printf('%s ', $node, $insert);
The best way would be to not echo HTML at all, but to embed PHP in HTML:
<?php
$node = $name->item(0)->nodeValue;
$insert = "cubicle" . $node;
?>
<td>
<a href= "#" onClick="showDetails('<?php echo $node;?>');">
<?php echo $insert; ?> <br />
</a>
</td>
You have to think less about quotes and debugging your HTML is easier too.
Note: If $node is representing a number, you don't need quotations marks around the argument.
you shouldn't be wrapping $node in '"':
Echo '<a href= "#" onClick= showDetails($node);>'. $insert .'</a> ';
If you want the value of $node to be in a string, thn i would do:
Echo '<a href= "#" onClick= showDetails("' . $node. '");>'. $insert .'</a> ';
$var = "Hello World!";
echo "$var"; // echoes Hello World!
echo '$var'; // echoes $var
Don't mix up " and ', they both have importance. If you use some " in your string and don't want to use the same character as delimiter, use this trick:
echo 'I say "Hello" to ' . $name . '!';
I think you are searching for PHP function json_encode which converts PHP variable into JavaScript object.
It's more secure than passing the value right in the output.
Echo '<a href= "#" onClick= showDetails("'.$node.'");>'. $insert .'</a> ';
I have been using curly braces lately instead of concatenation. I think it looks better/is more readable, and mostly I find it is easier and less prone to human error - keeping all those quotes straight! You will also need quotes around the contents inside of onClick.
Instead of this:
Echo '<a href= "#" onClick= showDetails($node);>'. $insert .'</a> ';
Try this:
Echo '{$insert} ';
As a side note, I usually use double quotes to wrap my echo statement and strictly use single quotes within it. That is just my style though. However you do it, be sure to keep it straight. So my version would look like this:
echo "<a href='#' onClick='showDetails({$node});'>{$insert}</a>";

How do i enclose the Single Quotes within double quotes for php variables to be interpreted

$URN = 1
$col2 = ABC
$qty = 10
the above 3 values needs to be put in span tag such as <span id ='$URN:$col2'>$qty</span>:
$row['col1'] = "<span id = '".$urn."'>".$qty."</span>";
but I am getting an error.
Using single quotes:
$row['col1'] = "<span id = '".$URN.":".$col2."'>".$qty."</span>";
Using double quotes:
$row['col1'] = "<span id = \"".$URN.":".$col2."\">".$qty."</span>";
You've got a few choices.
a. String concatenation with single quotes
$row['col1'] = '<span id="' . $urn . '">' . $qty . '</span>
b. Double quotes and escapes:
$row['col1'] = "<span id=\"{$urn}\">{$qty}</span>";
c. HEREDOC
$row['col1'] = <<<EOL
<span id="{$urn}">{$qty}</span>
EOL;
Variable names are case sensitive in PHP.
If you're getting "Undefined variable" error - well, this is it.
$row['col1'] = "<span id = '$URN:$col2'>$qty</span>";
I can't see any syntax errors, but the following would be a lot more readable:
$row['col1'] = "<span id='$urn'>$qty</span>";
It might help if you were more specific about the mysterious error you are getting.
To get exacly what you asked you need:
$row['col1'] = "<span id = '".$urn.":".$col2."'>".$qty."</span>";
I avoid needing to think about this problem by using the sprintf function when I want to generate HTML.
Please escape your output (otherwise you're just opening the door for possible XSS attacks:
(Assuming UTF-8 Character set):
$row['col1'] = '<span id="'.
htmlspecialchars($urn, ENT_COMPAT, 'UTF-8').
'">'.
htmlspecialchars($qty, ENT_COMPAT, 'UTF-8').
'</span>';

Categories