Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.javascript > #28798

Re: How to pass a php variable to a javascript file (function)?

Show all headers | View raw

On 2015-10-02 21:37, Thomas 'PointedEars' Lahn wrote:
> Stefan Weiss wrote:
>> That doesn't mean that json_encode() by itself is enough to safely
>> escape strings as JavaScript literals. What if $sometext contains
>> "</script>"?
> 
> Not a problem in HTML5 or XHTML(5), but in HTML < 5.

That is incorrect, see below.

>> | Note: The easiest and safest way to avoid the rather strange
>> | restrictions described in this section is to always escape "<!--" as
>> | "<\!--", "<script" as "<\script", and "</script" as "<\/script"  […]
> 
> And it is wrong *again* (see below).  For example, if you had a RegExp 
> literal in your ECMAScript or Perl code to match “<script” (which as for 
> ECMAScript code can be useful for retrieving embedded data), which would 
> likely be /<script…/, then changing that to /<\script…/ would attempt to 
> match “<”, followed by ECMAScript/Perl whitespace, followed by “cript…” 
> instead.

What the hell are you rambling about? Nobody said anything about Perl
regexes. I wrote (quoted) that "<script" should be replaced with
"<\script". No regexes, no imaginary errors, just plain string
replacement. Look:

    str_replace("<script", "<\script", $some_text);

Done. And even *IF* it was a Perl regex (which is a completely random
and off-topic assumption), the "\s" is in the replacement part, not in
the matching part. In Perl, you'd write

    s#<script#<\\script#g;

(or even with a single backslash if warnings are off)
No whitespace is matched anywhere.

> [...] the HTML5 Specification (fortunately) does not even define
> syntax that would require  “</script>” in a “script” element to be
> escaped in any way [...] The authors of this paragraph did not know
> what the hell they were doing [...] one cannot trust the authors of
> HTML Specifications regarding advice relevant to Web programming
> languages [...]

It is an awkward area of the specification, I grant you that. They
pretty much acknowledge that when they mention the "rather strange
restrictions". They were trying to remain backward compatible with
existing usage (up to a point), which is why we still have those
slightly absurd edge cases with <!--, <script> etc.

But they did get it right, or at least they and the current user agents
agree. You apparently don't, but you're the odd one out here. By all
means, go ahead and write something like this:

<script>
  console.log("This is just a string</script>");
  console.log("And this is another");
</script>

If you think that's safe, good luck to you. You're going to need it.

By the way, you also mentioned this wouldn't be a problem in XHTML.
To get a valid XML document, you'll have to escape much more than the
strings I mentioned.

> In fact, the easiest and safest way to avoid the issue is to put the script 
> code in a separate file,

Maybe, but that's not what the question was about. It also has nothing
to do with safe escaping of string literals in an HTML document.
Sometimes you have to pass values from the server side to the client
side. If you don't do that in an inline script, you'll have to make the
included script itself dynamic (as in, generated by PHP etc).

>> if we knew that `some_string` is relatively short, we could suggest
>> passing it along to index.html in the query string.
>>
>>   location.href = "index.html?s=" + encodeURIComponent(some_string);
...
> It is important to emphasize “relatively short”, because this approach is 
> subject to IE URL length limits

Yes, I know, that's why I said "relatively".


In any case, thanks for reminding me why I left this group in the first
place. It was specifically so I don't have to deal with your incessant
and pedantic and pointless nitpicks any longer. Even when you're proven
wrong you would *never* admit to making a mistake. Some scientist you are.


- stefan

Back to comp.lang.javascript | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

How to pass a php variable to a javascript file (function)? JiiPee <no@notvalid.com> - 2015-10-02 00:13 +0100
  Re: How to pass a php variable to a javascript file (function)? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2015-10-02 09:44 +0200
    Re: How to pass a php variable to a javascript file (function)? Stefan Weiss <krewecherl@gmail.com> - 2015-10-02 12:14 +0200
      Re: How to pass a php variable to a javascript file (function)? JiiPee <no@notvalid.com> - 2015-10-02 11:43 +0100
      Re: How to pass a php variable to a javascript file (function)? JiiPee <no@notvalid.com> - 2015-10-02 11:58 +0100
        Re: How to pass a php variable to a javascript file (function)? Stefan Weiss <krewecherl@gmail.com> - 2015-10-02 13:38 +0200
          Re: How to pass a php variable to a javascript file (function)? JiiPee <no@notvalid.com> - 2015-10-02 12:53 +0100
            Re: How to pass a php variable to a javascript file (function)? JiiPee <no@notvalid.com> - 2015-10-02 13:46 +0100
            Re: How to pass a php variable to a javascript file (function)? Ben Bacarisse <ben.usenet@bsb.me.uk> - 2015-10-02 13:51 +0100
          Re: How to pass a php variable to a javascript file (function)? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2015-10-02 21:42 +0200
            Re: How to pass a php variable to a javascript file (function)? Stefan Weiss <krewecherl@gmail.com> - 2015-10-03 00:33 +0200
              Re: How to pass a php variable to a javascript file (function)? JiiPee <no@notvalid.com> - 2015-10-02 23:45 +0100
              Re: How to pass a php variable to a javascript file (function)? Tim Streater <timstreater@greenbee.net> - 2015-10-02 23:55 +0100
            Re: How to pass a php variable to a javascript file (function)? JiiPee <no@notvalid.com> - 2015-10-03 00:02 +0100
          Re: How to pass a php variable to a javascript file (function)? JiiPee <no@notvalid.com> - 2015-10-02 23:49 +0100
      Re: How to pass a php variable to a javascript file (function)? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2015-10-02 21:37 +0200
        Re: How to pass a php variable to a javascript file (function)? Stefan Weiss <krewecherl@gmail.com> - 2015-10-03 00:34 +0200
          Re: How to pass a php variable to a javascript file (function)? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2015-10-03 04:35 +0200
            Re: How to pass a php variable to a javascript file (function)? Stefan Weiss <krewecherl@gmail.com> - 2015-10-05 01:11 +0200
              Re: How to pass a php variable to a javascript file (function)? Tim Streater <timstreater@greenbee.net> - 2015-10-05 09:13 +0100
              Re: How to pass a php variable to a javascript file (function)? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2015-10-06 03:30 +0200
                Re: How to pass a php variable to a javascript file (function)? Stefan Weiss <krewecherl@gmail.com> - 2015-10-10 00:27 +0200
        Re: How to pass a php variable to a javascript file (function)? Joao Rodrigues <groups_jr-1@yahoo.com.br> - 2015-10-03 15:15 -0300
          Re: How to pass a php variable to a javascript file (function)? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2015-10-03 20:34 +0200
            Re: How to pass a php variable to a javascript file (function)? Joao Rodrigues <groups_jr-1@yahoo.com.br> - 2015-10-03 15:59 -0300
              Re: How to pass a php variable to a javascript file (function)? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2015-10-03 22:15 +0200
    Re: How to pass a php variable to a javascript file (function)? JiiPee <no@notvalid.com> - 2015-10-02 11:36 +0100
      Re: How to pass a php variable to a javascript file (function)? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2015-10-02 16:34 +0200
        Re: How to pass a php variable to a javascript file (function)? JiiPee <no@notvalid.com> - 2015-10-02 16:00 +0100
          Re: How to pass a php variable to a javascript file (function)? Tim Streater <timstreater@greenbee.net> - 2015-10-02 16:03 +0100
            Re: How to pass a php variable to a javascript file (function)? JiiPee <no@notvalid.com> - 2015-10-02 17:08 +0100
  solution, thanks, seems like one suggestion lead to a solution JiiPee <no@notvalid.com> - 2015-10-02 17:07 +0100
    Re: solution, thanks, seems like one suggestion lead to a solution "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2015-10-02 20:29 +0200

csiph-web