I'm trying to pass a parameter from php into my javascript function inside html. Is this at all possible? This is what I've got so far, but it seems to crash once it hits the condition:
$str="<input type='submit' value='-' onclick='Call(".$row['field1'].");'/>";
I hope that I won't have to find a work around for this.
Thanks.
EDIT:
This is the function that I'm trying to call
function Call(stuff)
{
alert(stuff);
$.get('reports.php',
{'param':'section', 'text':stuff},
function(returned_data)
{
alert(returned_data);
});
//alert('end');
}
And this is the function that I'm populating a table with.
function PopTable()
{
alert('end');
document.getElementById('table').innerHTML = 'Loading...';
$.get('reports.php',
{'param':'getstuff'},
function(returned_data)
{
document.getElementById('table').innerHTML = returned_data; // Clear the select
});
alert('end');
}
This is the php that I'm sending back population the table:
$str.= '<tr>';
$str.='<td bgcolor="#ffffff">' . $row['stuff'] .'</td>';
$str.='<td><input type='submit' value='-' onclick="Call('$row['stuff']');"/></td>';
$str.='</tr>'; //accumulate table
I can't seem to get a return value for Call(), and the alert doesn't even pop up
Try:
$str='<input type="submit" value="-" onclick="Call(\''.$row['field1'].'\');"/>';
I would bet you need quotes around the value if it is a string value
For example if $row['field1'] = 'test'; then:
Your version: <input type='submit' value='-' onclick='Call(test);'/> which would fail because test is not a valid variable
My Version <input type="submit" value="-" onclick="Call('test');"/> which would work becase 'test' is a string
What you're trying to do is possible, whereas it is not possible to pass a parameter from JavaScript into a PHP function.
When you say it crashes once it hits the condition, do you mean when you click on the input on the page? In that case, it's an error in your JavaScript syntax. I would try using Firebug with Firefox to track down the issue.
My first guess is there are no quotation marks inside the Call() method. So you're doing this:
Call(something)
and it should be like this:
Call('something')
This is possible, but I would be very careful about mixing PHP echos and javascript inline with strings because you need to escape javascript datatypes properly
In your example, $row['field1'] is probably from a database, so it's a string, so you need to surround the value with quotes in your javascript call. But that's not all, because what if there's a quote in your string, or a special character like a newline which needs to be escaped in javascript? And then what about html escaping?
A better approach is to import your javascript values in one place using json_encode(), then use your variables from there.
E.g.:
<?php
$jsonrow = json_encode($row);
?>
<script type="text/javascript">
var jsrow = <?=htmlspecialchars($jsonrow);?>;
</script>
<?php // some time later... ?>
<input type="submit" value="-" onclick="Call(jsrow.field1);" />
Related
echo "<button onClick='follow(".$name.");'></button>";
I need to pass a string as a parameter in follow(user) function onClick event jquery. But it's getting called as a value.
I tried kind of everything, but in php it looks a bit of a big deal for me. Is there any other way around to get the expected result as a string from a php variable.
You echo a php variable in javascript without adding quotes thus ending with a javascript variable name instead of a string.
Just add escaped quotes like this:
echo "<button onClick='follow(\"".$name."\");'></button>";
Quotes are off and if you're passing a string you need quotes wrapping the string in the function call.
There is various ways to do it, for standard " in html properties:
echo '<button onClick="follow(\''.$name.'\')"></button>';
echo "<button onClick=\"follow('".$name."')\"></button>";
echo "<button onClick=\"follow('$name')\"></button>";
for single quotes
echo '<button onClick=\'follow("'.$name.'")\'></button>';
echo "<button onClick='follow(\"".$name."\")'></button>";
echo "<button onClick='follow(\"$name\")'></button>";
But that's presuming your users are nice, a crafty user may create a username with \n in it, then from POSTing to storing and retrieving it would most likely be rendered as a new line:
<?php
$name = "Foo\nBar";
echo '<button onClick="follow(\''.$name.'\')"></button>';
Rendering the following which would cause the page to break:
<button onClick="follow('Foo
Bar')"></button>
Or worse a username like:
$name = "Foo')\"></button>\n<button onClick=\"window.location.href = ('http://example.com";
Which would render a stored XSS:
<button onClick="follow('Foo')"></button>
<button onClick="window.location.href = ('http://example.com')"></button>
So a better solution then to directly pass it in, would be to escape it, using htmlentities and json_encode so \n is not rendered by the html.
echo '<button onClick=\'follow('.json_encode(htmlentities($name, ENT_QUOTES, 'UTF-8')).')\'></button>';
Which would render to:
<button onClick='follow("Foo')"><\/button>\n<button onClick="window.location.href = ('http:\/\/example.com")'></button>
Though you should be validating usernames on create before allowing such an attack.
I have a php page which i have array of values with long values.
I gave to pass this array in a javascript function like this
$canswer is an array
I am imploding that and passing as arguments as follows,
$cans=implode(',',$canswer);
echo "<input type='checkbox' name='q1' id='1' onclick=\"save_answer('1','$cans')\">";
This code is working for short values in array.When I have long values in array,onclick is not working.When I tried to see view source,I saw the array values cut off in the page.
I have tried the following code to give quotes for each values.But this also not works.
$correctanswer1="'" . implode("','", $correctanswer) . "'";echo $correctanswer1;
Regards,
Rekha
You could save the array of values as a javascript string on the page, then call the string in the onclick attribute.
<script type="text/javascript">
cans_string = '<?php echo implode(',',$canswer); ?>';
</script>
<input type="checkbox" name="q1" id="1" onclick="save_answer('1',cans_string)">
explore the array before to add it as parameter (print_r?)
extract javascript function into an javascript file
use jason to pass array as a parameter
Hope this will solve the problem
You're probably not escaping some of the special characters in your output. Run your output through htmlentities or htmlspecialchars to eliminate characters that will break your HTML or javascript.
$cans=htmlentities(implode(',',$canswer), ENT_QUOTES);
echo "<input type='checkbox' name='q1' id='1' onclick=\"save_answer('1','$cans')\">";
Pay attention to where your output is breaking, and what characters could be breaking it.
Say I have 3 variables, id, name, number, on a php script, $name, $number, $id
On the PHP, I create a button
print "<td><form><input type='button' name='edit' id='edit' onclick=ed($name, $number, $id) value='Edit' /></td>";
I want those 3 variables sent to my javascript.
The function call seems to work just fine if I use
onclick=ed(this.id)
and modify the function header, and this passes the string "edit" but that's not quite useful.
function header in javascript is
function ed(name, number, id) {
//stuff here
}
For whatever it's worth using this code gets me an error on the html, something about an unexpected } on line2 of the html document.
Edit:I should clarify I said that code gives me errors so someone didn't just say "Well use this!" when I already expected it not to work.
Using this:
<input type='button' id='$id' onclick=ed(this.id) value='Edit' />
Allows me to send the value in $id to the javascript function because it was saved in the id field. Something along those lines is what I'm hoping for, but I'm unable to find if there's any way to do that. edit: for 3 variables.
Edit again:
Using:
<form><input type='button' name='$name' id='$id' title='$number' onclick='ed(this.name,this.title,this.id)' value='Edit' /></form>
sent the values of all 3 php variables to the javascript function.
It's not pretty, but it works.
For custom attributes define data-attributes, e.g. as shown on Mozilla Dev:
<div id="user" data-id="1234567890" data-user="johndoe" data-date-of-birth>John Doe
</div>
var el = document.querySelector('#user');
// el.id == 'user'
// el.dataset.id === '1234567890'
// el.dataset.user === 'johndoe'
// el.dataset.dateOfBirth === ''
el.dataset.dateOfBirth = '1960-10-03'; // set the DOB.
// 'someDataAttr' in el.dataset === false
el.dataset.someDataAttr = 'mydata';
// 'someDataAttr' in el.dataset === true
In your case, it seems you only need data-number as the other two are standard properties of the DOM-element.
I think the problem is with your quotes so try this
print '<td><form><input type="button" name="edit" id="edit" onclick=ed('.$name.','.$number.','.$id.') value="Edit" /></td>'
You can only send 3 value like this:-
onclick="javascript:func_name('<?php echo $var1 . "," . $var2 . "," . $var3;?>');
In the js function take only one argument and then split 3 values using "," as a delimiter.
I have searched for that, i got some ideas from following site also.
Passing PHP array into external Javascript function as array
My sample code is below:
<?php $array_sample = array("c1","c2"); $newArray = json_encode($array_sample); ?>
<INPUT type="button" value="Php Array" onclick="Test(<?php echo $newArray ?>)" />
<script language="javascript"> function Test(test_arr){ alert(test_arr); }</script>
For above code, I am getting undefined as alert message.
Any Help would be appreciated.
When you use json_encode(), double-quotes are preserved in the result. So, json_encode($array_sample) produces:
["c1","c2"]
When this is put into your HTML, you have:
<INPUT type="button" value="Php Array" onclick="Test(["c1","c2"])" />
If you can tell, the double-quotes from your json-output break the HTML which break what's passed to the Test() method.
To fix this, you could use htmlentities() to convert the double-quotes to HTML-values ":
<INPUT type="button" value="Php Array" onclick="Test(<?php echo htmlentities($newArray) ?>)" />
EDIT (htmlentities() vs. addslashes())
It appears that using addslashes() actually won't work because an escaped double-quote in an attribute, such as onclick="Test(\"value\")" is invalid. However, an html-entity version such as onclick="Test("value")" works.
Because of this, I have changed my original answer from "use addslashes()" to "use htmlentities()").
I've seen numerous posts on how to do this either saying to use rawurlencode in the php and decodeURIComponent in javascript or just use json_encode. Neither work for me. Hoping someone can see what I'm doing wrong:
I have an html button like this:
<button id="editbutton" onClick='edit(this, "<?php echo htmlentities($_SERVER['REQUEST_URI']); ?>", "<?php echo $result_cameras[$i]["camera_type"]; ?>", "<?php echo rawurlencode($result_cameras[$i]["camera_name"]); ?>")'>Edit</button>
I pass that into the javascript edit button:
var edit = function(t, to, cameratype, cameraname, cameraquality, camerahash, camerastatus, emailnotice, camerasensitivity, axisuser, axispass, axisip, axisport)
{
if (mydiv.find("form").length) {
mydiv.show();
} else {
// fields
var $myform = $("<form id='EditCameraForm' name='' method='post' action='" + to + "'></form>");
var $myfieldset = $("<fieldset><legend>Edit camera settings</legend></fieldset>");
var $myinput = $('<input/>').attr('type','hidden').attr('name','camera_type').val(cameratype);
var $mylabel = $("<label for='CameraName'>Camera name: </label>");
var $myinput2 = js('<input/>').attr('size','25').attr('name','camera_name').attr('id','CameraName').val(decodeURIComponent(cameraname));
$myform.append($myinput, $mylabel, $myinput2);
...
}
...
}
I've tried using rawurlencode/decodeURIComponent as above and when I hit the edit button if the camera name is called: a"a (just testing the quotes) I get a"a. Backslashes such as a\b just returns some weird characters back.
If I try:
<?php echo json_encode($result_cameras[$i]["camera_name"]); ?>
and don't put anything in the javascript code I get this error:
missing ) after argument list
edit(this, "/dashboard", "WEBCAM", ""a"a"", "0", "3dd10c49784e2207de1e1932958bfb...
Where it is pointing to the ""a"a"".
Any suggestions?
You are in effect outputting a javascript string literal, so using htmlentities is not the correct thing to do. What you need instead is addslashes:
<?php echo addslashes($_SERVER['REQUEST_URI']); ?>
Edit: It goes without saying that you also need to do this for the other two strings you are echoing.
The reason this is correct is that the escape sequences for Javascript string literals are compatible with what addslashes does, if you ignore the fact that addslashes also escapes the "null" character. However, there's no way that character will be part of your URL so there is a perfect match between what addslashes does and what Javascript expects from its string literals.
For completeness I should mention that an appropriate usage of htmlentities is to process text that is being sent as part of HTML content; even then, htmlspecialchars (which performs a small subset of the work of htmlentities) is almost always the better fit.
rawurlencode() is for converting a string to an URL argument
htmlentities() is for converting a string to an HTML content
If you'd like to convert a string to a Javascript string it should be :
function f_str_2js($x) {
return str_replace( array("\n","\r","\t","'",'"') , array('\n','\r','\t',"\\'",'\"') , $x)
}
the above answers are correct, but you should consider to add your data to a php array or object, than jsonencode and add it to a date-attribute date-camera='{... than do eventbinding by using jQuery .on(.
This way you can access the data via $(this).data('camera'). It will be easy to extend you app without adding more and more parameters to the onclick-function.
for more information see:
http://api.jquery.com/jQuery.data/
http://api.jquery.com/on/