Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.javascript > #28818

Re: How to pass a php variable to a javascript file (function)?

Show all headers | View raw

In the interest of brevity, and my own sanity, I chose not to respond to
the following parts of your post:

- The lengthy excursion about PHP coding style. It has nothing to do
with the topic. Use whatever style of quoting and escaping you prefer.

- That embedded script content in an XML document should be in a CDATA
section. We're in agreement there. To simply _assume_ that we are in a
CDATA context when we were talking about escaping was a little
underhanded, but since we agree about the main point, let it rest.

- Further evangelizing the use of linked scripts vs inline scripts.
Preaching to the choir. I agree. But this is NOT what we're talking
about here, it merely provides an alternative.

- Spockisms.


On 2015-10-06 03:30, Thomas 'PointedEars' Lahn wrote:
>>>>     str_replace("<script", "<\script", $some_text);
>>>> 
>>>> Done.
>>> No.
>> ...because? A simple unqualified "no" is not good enough.
> Read further below.

I read everything you wrote "further below", but you still failed to
demonstrate how this method of escaping could be harmful. Give an
example or concede the argument.

>> This is not about escaping code, it's about escaping the contents of a
>> string in a <script> element.
> 
> No, the knee-jerk assertion in the HTML Specification note (in fact, the 
> requirement in this case) is to escape or avoid *all* offending code in a 
> “script” element¹.  For an HTML parser makes no difference whether the 
> offending code is in a string literal; it does not (need to) know about 
> string literals in embedded, non-HTML code.

You're getting sidetracked by the examples in the specification again.
You keep bringing up all kinds of contexts except the one we were
originally discussing: transferring a PHP string value to a JS string
literal in an embedded script in an HTML document.

> Further, the contents of a (string in a) “script” element *is* (source) 
> code, and it can be code that contains expressions like such literals.  
> Where such blindfolded escaping *can* change the meaning of the code.

You get no points for just claiming that, without proof.

[referring to where I wrote "a <script> element"]

> ¹  Although unfortunately common, it is wrong to write “<script>” etc. in
>    that regard; “<script>” is only the start-tag of the “script” element,
>    and only a particular variant of it.

You know... if you're ever wondering why they're calling you a pedant,
*that* is precisely the reason. In the same vein, you'll probably object
to somebody mentioning the sprintf() function - because it's really the
“sprintf” function? Stop trying to distract with nitpicks and inane
overcorrections and get to the point.

>> It's not just Chrome, you get the exact same behavior in Firefox and
>> IE/Edge. […]
> 
> I have not doubted that, which you could have read further below.  
> Superficial reading appears to be the major cause of your misconceptions.

Maybe you're just not communicating very well. Reading this passage
again, I still cannot identify what exactly you're referring to as
"further below". Not that it matters.

>>>      // escape “]]>” here if “<” follows
>> 
>> ... but not like that!
> 
> Well, it is rather difficult to give a description of the CDATA section end 
> marker in a comment without mentioning it.
...
> If you can live better with that, replace the line in the example with
> 
>   // escape the CDATA section end marker here if “<“ follows

You completely missed the point. I wasn't criticizing the
well-formedness of your example, that would be ridiculous. I was talking
about its actual content - what to escape, and when:

    <script type="text/javascript">// <![CDATA[
        console.log("This is ]]> just a string.");
    // ]]></script>

This follows your described escaping rule and leads to a ruined XML
document. See, an actual example. How hard is that?

Looking forward to seeing one from you.


- stefan

Back to comp.lang.javascript | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

How to pass a php variable to a javascript file (function)? JiiPee <no@notvalid.com> - 2015-10-02 00:13 +0100
  Re: How to pass a php variable to a javascript file (function)? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2015-10-02 09:44 +0200
    Re: How to pass a php variable to a javascript file (function)? Stefan Weiss <krewecherl@gmail.com> - 2015-10-02 12:14 +0200
      Re: How to pass a php variable to a javascript file (function)? JiiPee <no@notvalid.com> - 2015-10-02 11:43 +0100
      Re: How to pass a php variable to a javascript file (function)? JiiPee <no@notvalid.com> - 2015-10-02 11:58 +0100
        Re: How to pass a php variable to a javascript file (function)? Stefan Weiss <krewecherl@gmail.com> - 2015-10-02 13:38 +0200
          Re: How to pass a php variable to a javascript file (function)? JiiPee <no@notvalid.com> - 2015-10-02 12:53 +0100
            Re: How to pass a php variable to a javascript file (function)? JiiPee <no@notvalid.com> - 2015-10-02 13:46 +0100
            Re: How to pass a php variable to a javascript file (function)? Ben Bacarisse <ben.usenet@bsb.me.uk> - 2015-10-02 13:51 +0100
          Re: How to pass a php variable to a javascript file (function)? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2015-10-02 21:42 +0200
            Re: How to pass a php variable to a javascript file (function)? Stefan Weiss <krewecherl@gmail.com> - 2015-10-03 00:33 +0200
              Re: How to pass a php variable to a javascript file (function)? JiiPee <no@notvalid.com> - 2015-10-02 23:45 +0100
              Re: How to pass a php variable to a javascript file (function)? Tim Streater <timstreater@greenbee.net> - 2015-10-02 23:55 +0100
            Re: How to pass a php variable to a javascript file (function)? JiiPee <no@notvalid.com> - 2015-10-03 00:02 +0100
          Re: How to pass a php variable to a javascript file (function)? JiiPee <no@notvalid.com> - 2015-10-02 23:49 +0100
      Re: How to pass a php variable to a javascript file (function)? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2015-10-02 21:37 +0200
        Re: How to pass a php variable to a javascript file (function)? Stefan Weiss <krewecherl@gmail.com> - 2015-10-03 00:34 +0200
          Re: How to pass a php variable to a javascript file (function)? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2015-10-03 04:35 +0200
            Re: How to pass a php variable to a javascript file (function)? Stefan Weiss <krewecherl@gmail.com> - 2015-10-05 01:11 +0200
              Re: How to pass a php variable to a javascript file (function)? Tim Streater <timstreater@greenbee.net> - 2015-10-05 09:13 +0100
              Re: How to pass a php variable to a javascript file (function)? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2015-10-06 03:30 +0200
                Re: How to pass a php variable to a javascript file (function)? Stefan Weiss <krewecherl@gmail.com> - 2015-10-10 00:27 +0200
        Re: How to pass a php variable to a javascript file (function)? Joao Rodrigues <groups_jr-1@yahoo.com.br> - 2015-10-03 15:15 -0300
          Re: How to pass a php variable to a javascript file (function)? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2015-10-03 20:34 +0200
            Re: How to pass a php variable to a javascript file (function)? Joao Rodrigues <groups_jr-1@yahoo.com.br> - 2015-10-03 15:59 -0300
              Re: How to pass a php variable to a javascript file (function)? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2015-10-03 22:15 +0200
    Re: How to pass a php variable to a javascript file (function)? JiiPee <no@notvalid.com> - 2015-10-02 11:36 +0100
      Re: How to pass a php variable to a javascript file (function)? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2015-10-02 16:34 +0200
        Re: How to pass a php variable to a javascript file (function)? JiiPee <no@notvalid.com> - 2015-10-02 16:00 +0100
          Re: How to pass a php variable to a javascript file (function)? Tim Streater <timstreater@greenbee.net> - 2015-10-02 16:03 +0100
            Re: How to pass a php variable to a javascript file (function)? JiiPee <no@notvalid.com> - 2015-10-02 17:08 +0100
  solution, thanks, seems like one suggestion lead to a solution JiiPee <no@notvalid.com> - 2015-10-02 17:07 +0100
    Re: solution, thanks, seems like one suggestion lead to a solution "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2015-10-02 20:29 +0200

csiph-web