ansaurus

Question

Answer 1

+1 A:

<?
   echo "<script type=\"text/javascript\">\n"; 
   echo "alert('$msg1" . '\n' . "$msg2');";
   echo "</script>"; 
?>

EDIT: But your users may find alert annoying. Look into DIV-based dialogs.

"alert('$msg1" and "$msg2');" use double quotes to allow for variable interpolation. '\n' is single-quoted so backslash will not be an escape (we want it to be interpreted by JS, not PHP). . is PHP's concatenation operator.

Matthew Flaschen 2010-04-23 01:24:05

You might want to fix the syntax while you're at it... :)

deceze 2010-04-23 01:28:50

You can probably drop the language attribute as it isn't used anymore.

alex 2010-04-23 01:29:06

You might need to explain why you quoted the `\n` different.. i.e. what delimiters such as " and ' do and do not.

alex 2010-04-23 01:32:09

$msg1 and $msg2 might contain apostrophes or the characters "</script" which needs to be escaped.

thomasrutter 2010-04-23 02:18:23

@Ben, actually alex is right. 4.01 Strict requires `type` for script. It doesn't even allow `language`.

Matthew Flaschen 2010-04-23 02:38:27

Misreaded, my bad

Ben 2010-04-23 03:16:38

Answer 2

A:

Instead of:

   echo "alert('$msg1')";
   echo "alert('$msg2')";

Try:

   echo "alert('$msg1, $msg2')";

Ganesh Shankar 2010-04-23 01:25:56

i try this one but got message on "stack overflow..." What's that for? thx

2010-04-23 05:19:12

Answer 3

A:

Here is modified example from w3schools.com tutorial if you want to display messages before submit is processed:

<html>
   <head>
      <script type="text/javascript">
         function disp_alert()
         {
           <?php echo "alert('".$msg1.'\n'.$msg2."');"; ?>
         }
      </script>
   </head>
   <body>  
      <input type="button" onclick="disp_alert()" value="Display alert box" />    
   </body>
</html>

bancer 2010-04-23 02:17:23

Answer 4

+1 A:

There's a few other issues here.

It is using Javascript alert boxes, which are ugly, and modal. It's bad for users. Modal in the whole-of-browser sense, so (depending on the browser) users can't even go and do something in another tab while this message is on screen; they must dismiss it first. It's much better to place the message in a well styled <div> for example. You could still use some unobtrusive script (like jQuery) to allow users to hide the box if you were so inclined.
Any apostrophes in $msg1 and $msg2 won't be escaped in the Javascript output. This can be a security problem if you're accepting user input as part of these variables. You could use addslashes() to partially fix this, but you'd also need to escape the characters "</" (or "</script" if using HTML) if they might appear, and possibly other variants too.

If you read and accept the above problems and still want to achieve this, here's a safer (though I'm still not sure if it's perfectly safe) alternative:

<?
echo "<script type=\"text/javascript\">"; 
echo "alert('" . str_replace("</", "<'+'/", addslashes($msg1).'\n'.addslashes($msg2)) . "');";
echo "</script>"; 
?>

thomasrutter 2010-04-23 02:17:35

ansaurus

tags:

views:

answers:

Javacsript in PHP code

related questions