Show image title in a javascript pop up? - php

Question

I'm having trouble with a javascript pop up. I want the pop up to show the image reason/Title.
Anyone know what to do?
The code:
<?
$badgesql = mysql_query("select * from usr_badge where user = '$_SESSION[usr_name]'");
$user = mysql_query("select * from usr_users where username = '$_SESSION[usr_name]'");
$usr = mysql_fetch_array($user);
$vipsql = mysql_query("select * from usr_vip where userid = '$usr[id]'");
$vipcheck = mysql_num_rows($vipsql);
$badgecheck = mysql_num_rows($badgesql);
$checkit = $badgecheck + $vipcheck;
if($checkit==0)
echo("You have 0 Badges");
if($badgecheck!=0)
{
while($badge = mysql_fetch_array($badgesql))
{
echo('<img src="/css/badges/'.$badge[badge].'" onclick="alert('.$badge[reason].');" />'); }
}
//Display VIP Badges
if($vipcheck!=0)
{
$vipbadge = mysql_fetch_array($vipsql);
$vip1 = mysql_query("select * from usr_vipdb where id = '$vipbadge[vipid]'");
$vip2 = mysql_fetch_array($vip1);
echo('<img src="'.$vip2[url].'" alt="This user is a VIP!" />');
}
?>
Thanks in advance!

Answer 1

The problem is you need some quotes within your alert().
echo('<img src="/css/badges/'.$badge['badge'].'" onclick=\'alert("'.htmlentities($badge['reason']).'");\' />');
Also, $badge[reason] is bad practice (unless reason is a constant which I don't think is). Use single quotes like in the example above.
Finally, use htmlentities() when you're printing content to HTML.

Answer 2

The inline JavaScript isn't exactly a proper one. When you echo the string the onclick attribute will contain the value that looks something like:
alert(image reason);
You need to enclose the reason of the image with quotes for it to work properly. Thus, your code should look like this instead:
echo '<img src="/css/badges/'.$badge[badge].'" onclick="alert(\''.$badge[reason].'\');" />'