strange quote behaviour in generated html

Question

I am using the following code snippet to generate a html form for use in a popup window:

$uploadhtml = "<form action='up.php' method='post'
enctype='multipart/form-data'>
<label for='file'>Filename:</label>
<input type='file' name='file' id='file'/> 
<br />
<input type='hidden' name='pk' value='".$pk."'>
<input type='hidden' name='username' value='".$USERNAME."'>
<input type='submit' name='submit' value='Submit' onclick=\"setTimeout(function() { updateByPk('Layer2', '".$pk."', '".$brand."', '".$pg."'); } ),1250);\" />
</form>";

Everything is escaped/quoted as it should be.

I am using $uploadhtml like so:

echo "<p><a href='#' onclick=\"makewindows('" . $uploadhtml . "'); return false;\">Upload files</a>";

Why then is the escaped html the following?

<a href="#" onclick="makewindows('<form action='up.php' method='post'
enctype='multipart/form-data'>
<label for='file'>Filename:</label>
<input type='file' name='file' id='file'/> 
<br />
<input type='hidden' name='pk' value='380118185183'>
<input type='hidden' name='username' value='janmaybach'>
<input type='submit' name='submit' value='Submit' onclick=" settimeout(function()="" {="" updatebypk(="" layer2="" 380118185183="" ,="" );="" }="" ),1250);="">
'); return false;"&gt;Upload files</a>

It is absolutely fine until it gets to the onclick parameter, and I see no reason it should generate it so obscurely.

Answer 1

double quotes instead of single quotes.

Answer 2

Because you are already inside a " and inside ':

<a href="#" onclick="makewindows('
                   ^^^          ^^^

you need to escape both your single and double quotes inside the variable, for example:

<input (...) value=\\'Submit\\' onclick=\\\"setTimeout

or just run it through an addslashes() function before inserting.

Answer 3

Use htmlspecialchars with ENT_QUOTES and json_encode if possible:

echo '<a href="#" onclick="makewindows('.htmlspecialchars(json_encode($uploadhtml), ENT_QUOTES).'); return false;">Upload files</a>';

---

Edit   And now the same in your quotation style:

echo "<p><a href='#' onclick=\"makewindows(".htmlspecialchars(json_encode($uploadhtml), ENT_QUOTES)."); return false;\">Upload files</a>";

You don’t need to surround the value you want to pass to the JavaScript function makewindows as json_encode already returns a valid string expression. And to avoid conflicts with the HTML attribute quotes, I used the htmlspecialchars function with ENT_QUOTES to replace both quote characters by corresponding HTML character references.