使用PDO MySQL查询将字符串传递给javascript

Question

I've got a table that has columns 'banned_ip' and 'reason', and I'm trying to display an error message specific to the banned user. For some reason, there seems to be a problem with displaying $row['reason']. Any ideas?

PHP:

$stmt = $conn->prepare('SELECT * FROM blackList WHERE banned_ip = :ip');
$stmt->execute(array('ip' => $_SERVER['REMOTE_ADDR']));

foreach ($stmt as $row) {
    echo "<script language='javascript'> displayBanError('" . $row['reason'] . "'); </script>";
}

JS:

function displayBanError(reason) {
    document.getElementById('error_field').innerHTML = "<p>Error: This IP has been blacklisted.<br>Reason: " + reason + "</p>";
}

Answer 1

Mixing plain PHP with JavaScript may be a hell, because of all these quotes and other characters to be escaped. Try to pass PHP -> JS strings base64-encoded in PHP, in JS there are functions to decode it back to readable form.

...or try Smarty.