onclick事件中的引用

Question

I had an onclick event as below.

<div onclick="display_function('<?php echo $user_id;?>','<?php echo $student_id;?>','<?php echo $student_name;?>')"></div>


function display_function(user_id,student_id,student_name)
{
   alert(user_id+'-'+student_id+'-'+student_name); //<-- testing only. I have my own code here
}

the function works fine with the name like Mary, Chris and etc.

However, if the student name contains a ', e.g. Cheng'li, the function won't work.

I need help to fix this. How can I make the function works by 'escaping' the quote mark in name?

Thanks.

Answer 1

You need to add a call to htmlentities around the data you wish to echo. Not doing so exposes your code to XSS attacks.