How can I set a string with parenthesis and other items to a variable in PHP?

Question

I am trying to test some of these code here http://ha.ckers.org/xss.html on my code. To do so I need to set the codes on that page into a PHP variable, I am having trouble though.

For example this code below is incorrect just for setting it to a variable because of the "code" and 'code' the '" is what I am talking about. How can I set code from that page or below into a PHP variable for testing?

$string = '<IMG SRC=\"javascript:alert('XSS');\"><b>hello</b> hiii';

Answer 1

You need to escape the quotes you used to declare the string with. So in your case the single quotes:

'<IMG SRC="javascript:alert(\'XSS\');"><b>hello</b> hiii'

Otherwise the string would be aborted with that unescaped quote.

Answer 2

Another way, maybe a bit easier (you don't have to escape the quotes, nor double-quotes) would be to use Heredoc syntax :

$string = <<<STR_1
<IMG SRC="javascript:alert('XSS');"><b>hello</b> hiii
STR_1;

Note you'll still have to escape the $ sign, if you have some, to not have varible interpolation.

Quoting the manual :

Heredoc text behaves just like a double-quoted string, without the double quotes. This means that quotes in a heredoc do not need to be escaped, but the escape codes listed above can still be used. Variables are expanded, but the same care must be taken when expressing complex variables inside a heredoc as with strings.

Note : read the manual about that : there are some things you must know before using heredoc syntax (like the fact that the closing identifier must be alone on its line)