PHP生成JavaScript onClick，带有php数组，引用问题

Question

echo '<a onClick="articleDeleteConfirm("'.
      $row["title_$lang"].'","'.$_GET["editPage"]).'">';

The main problem is with: $row["title_$lang"], i have to use $lang variable inside. " and ' just not enough.

Answer 1

The problem you describe actually has nothing to do with your PHP variables, those are all being output as expected. The problem is that you need to escape the " inside of the <a> and you've misplaced a ).

Your original would output:

<a onClick="articleDeleteConfirm("value1","value2">

That is not valid HTML (even the highlighter dislikes it). Now, notice the \'s in the following (and that the paren was moved into the string).

echo '<a onClick="articleDeleteConfirm(\''
     .$row["title_".$lang."].'\',\''.$_GET["editPage"].'\')">';

The escaped version outputs:

<a onClick="articleDeleteConfirm('value1','value2')">

It uses single quotes inside of double quotes to provide easy to read (and valid) html. Now, you have another issue with your code.

Any time you output a $_REQUEST variable to the browser, you risk something called cross-site-scripting. Someone could put JavaScript into $_GET["editPage"] and it would smell bad. The easy way to avoid it? Use htmlentities($_GET["editPage"])