$code = $_POST['code'];
echo "<script language='javascript'>
document.getElementById('code').value = $code </script>";
I tried '$code', "$code","..." + "%code + "...", and i cant change the textfield's value to the PHP value.
Mmm!!!
views:
138answers:
4
+3
A:
Try this :
$code = $_POST['code'];
echo "<script language=\"javascript\">
document.getElementById(\"code\").value =". $code. "</script>";
Or better yet :
<?php
$code = str_replace("'", "\'", htmlspecialchars($_POST['code']));
?>
<script type="text/javascript">
document.getElementById("code").value = "<?php echo $code;?>";//OR <?= $code;?>;
</script>
c0mrade
2010-03-22 18:44:48
+1 for the second option. Avoid echoing HTML if you can help it, it's much easier to maintain if the HTML is just part of the output. Also, if `$code` is a string, it will need to be `document.getElementById("code").value = "<?php echo $code;?>";` and possibly escape the `"` character.
Andy E
2010-03-22 19:06:13
@Andy E yes Andy I missed that one, fixed it tnx :D
c0mrade
2010-03-22 19:08:59
+3
A:
Does $code contain a string? If so you'll need to quote it.
e.g. if $code equals "my test string", the Javascript will be output like:
$code = $_POST['code'];
echo "<script language='javascript'>
document.getElementById('code').value = my test string </script>";
which is invalid Javascript.
You need to:
$code = str_replace("'", "\'", $_POST['code']);
echo "<script language='javascript'>
document.getElementById('code').value = '$code' </script>";
I would also do:
$code = str_replace("'", "\'", htmlspecialchars($_POST['code']));
htmlspecialchars quotes HTML characters to prevent XSS attacks.
Andy Shellam
2010-03-22 18:45:28
+1 for the right answer here. This is definitely what's causing his problem, just add quotes around $code. Also, as I commented before, this is very dangerous, make sure you sanitize the string as suggested by Michael Boyd. Escaping single and double quotes when putting js into a string will do the trick.
Juan Mendes
2010-03-22 18:56:57
Yesh! I'm the king of the world! I mean, Andy is ;)I checked htmlspecialchars documentation and it just converts special characters to HTML codification. What you are saying here is "replace ' and \ to HTML codification". How does this prevent a XSS attack?
Gabriel A. Zorrilla
2010-03-22 19:10:15
Because somebody could pass `<script>SendUserToMyFakeWebsite();</script>` into your POST variable, that will get printed as-is into your HTML, and the browser will execute it because it's `<script>`. Running it through `htmlspecialchars()` will output it as `<script>SendUserToMyFakeWebsite();</script>` which means nothing to the browser so the user will see the actual script instead of it being executed. http://en.wikipedia.org/wiki/Cross-site_scripting
Andy Shellam
2010-03-23 08:14:35
A:
PHP doesn't see the $code as you've written it. Use this instead:
$code = $_POST['code'];
echo "<script language='javascript'>
document.getElementById('code').value = ".$code."; </script>";
or
$code = $_POST['code'];
echo "<script language='javascript'>
document.getElementById('code').value = {$code}; </script>";
Either more explicitly allows PHP to recognise and parse your string.
Raise
2010-03-22 18:45:46