views:

120

answers:

2

Hi Guys,

I've the following problem, the following code:

$link = $_GET['link'];
$id = $_GET['block'];

echo "<p id='preview". $id ."'>The player will show in this paragraph</p>";
echo "<script type='text/javascript'>";

echo "var s" . $id . " = new SWFObject('" . COMPANY_URL . "/system/addons/player/player.swf','player". $id ."','210','170','9');";
echo "s" . $id . ".addParam('allowfullscreen','true');";
echo "s" . $id . ".addParam('allowscriptaccess','always');";
echo "s" . $id . ".addParam('wmode','opaque');";

echo "s" . $id . ".addVariable('file', '" . $link  . "&repeat=always&autostart=true');";
echo "s" . $id . ".addVariable('skin', '" . COMPANY_URL . "/system/addons/player/simple-sources.swf');";

echo "s" . $id . ".write('preview". $id ."');";   
echo "</script>";

This is called every time by a jQuery load (this works because the echo "<p id='preview". $id ."'>The player will show in this paragraph</p>"; is showing).

In IE the player just leaves the 'player will show in this paragraph' while in all others browsers it is replaced by the jw-player. I can't find any solution on the forum of the jw-player or on stackoverflow...

Hope you guys can help!

Updated The generated Source firebug

<p><div class="videofile" id="856">
<p id="preview856"><embed width="210" height="170" flashvars="file=http://DOMAIN/data/productinfo/pressbyopie/long-line/leesdeel-verdraait/1242649976__video_longline-verdraait.flv&amp;amp;repeat=always&amp;amp;autostart=true&amp;amp;skin=http://DOMAIN/system/addons/player/simple-sources.swf" wmode="opaque" allowscriptaccess="always" allowfullscreen="true" quality="high" name="player856" id="player856" src="http://DOMAIN/system/addons/player/player.swf" type="application/x-shockwave-flash"></p>  </div></p>
A: 

It doesn't help solve your problem, but I feel compelled to point out that the PHP is a XSS attack waiting to happen:

$id = $_GET['block'];

echo "<p id='preview". $id ."'>The player will show in this paragraph</p>";

Try using htmlspecialchars with ENT_QUOTES on the $id before echoing it straight out into the HTML.

Even if this isn't production code, I don't like leaving such things posted on the interwebs for others to copy & paste ;)


PS: Would have commented on your question instead of providing an "answer" but I don't have enough rep yet.

Day
A: 

There was a problem with the flv parsing I think.

when i added this:

echo "s" . $id . ".addParam('type','flv');";

It worked :)

Tim
@Tim That snippet comes after you ran `htmlspecialchars` on the `$id` right?
Day