Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #11356

Re: resolved?? Re: How to transfer value to iframe?

Show all headers | View raw

Norman Peelman wrote:

> On 10/10/2013 01:01 PM, richard wrote:
>> On Wed, 9 Oct 2013 22:32:22 -0400, richard wrote:
>>> http://mroldies.net/200/audiox.php
>>>
>>> First, the sound will work only in firefox.
>>> So don't go bashing me for that.
>>
>>
>> <?php
>> $number=$numbers[0];
>> echo '<iframe id="x1" src="audiox1.php?asong='.$number.'"
>> name="alpha"></iframe>';
>> ?>
>>
>> At least the first number is now displayed.
> 
> echo "<iframe id=x1
> src='audiox1.php?asong=$number&name=$alpha'></iframe>";

The safe syntax is

  echo "<iframe id=x1 
src='audiox1.php?asong={$number}&name={$alpha}'></iframe>";
 
> No need to quote the *values*, they are sent as text.

Utter nonsense.  Depending on the version of HTML and the attribute value, 
attribute values MUST be quoted.  The safe approach is to *always* quote 
attribute values, it certainly is when attribute values or parts of those 
are generated like here.  Since double-quoting is more common than single-
quoting, double-quoting as it was done by the OP actually is the safe 
approach.

You might have misread the original code, which is actually equivalent to

  echo '<iframe id="x1" src="audiox1.php?asong='
    . $number
    . '" name="alpha"></iframe>';

if we assume that the line-break after “$number.'"” was accidental 
originally or was inserted when you quoted the original code.

In particular, in your code the value of $alpha must be *URI-encoded* or the 
URI-reference that is the attribute value is invalid or the entire HTML 
fragment could become invalid (or code-injected) if $alpha contains space or 
special characters.  Other generated attribute values, unless it is certain 
that code injection is impossible (for example with int values), SHOULD be 
htmlspecialchars()'d.

> Not sure what you're doing with -alpha-, I assume it is a variable as
> well...

Does it look like one?  RTFM.


PointedEars
-- 
> If you get a bunch of authors […] that state the same "best practices"
> in any programming language, then you can bet who is wrong or right...
Not with javascript. Nonsense propagates like wildfire in this field.
  -- Richard Cornford, comp.lang.javascript, 2011-11-14

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

How to transfer value to iframe? richard <noreply@example.com> - 2013-10-09 22:32 -0400
  Re: How to transfer value to iframe? David Robley <me@home.invalid> - 2013-10-10 13:43 +1030
    Re: How to transfer value to iframe? richard <noreply@example.com> - 2013-10-09 23:31 -0400
      Re: How to transfer value to iframe? David Robley <me@home.invalid> - 2013-10-10 14:20 +1030
        Re: How to transfer value to iframe? richard <noreply@example.com> - 2013-10-10 00:01 -0400
          Re: How to transfer value to iframe? Jeff North <jnorthau@yahoo.com.au> - 2013-10-10 15:40 +1100
            Re: How to transfer value to iframe? richard <noreply@example.com> - 2013-10-10 00:51 -0400
              Re: How to transfer value to iframe? "J.O. Aho" <user@example.net> - 2013-10-10 07:10 +0200
            Re: How to transfer value to iframe? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2013-10-11 01:15 +0200
      Re: How to transfer value to iframe? Denis McMahon <denismfmcmahon@gmail.com> - 2013-10-10 13:25 +0000
  Re: How to transfer value to iframe? Denis McMahon <denismfmcmahon@gmail.com> - 2013-10-10 13:12 +0000
  resolved?? Re: How to transfer value to iframe? (was: How to transfer value to iframe?) richard <noreply@example.com> - 2013-10-10 13:01 -0400
    Re: resolved?? Re: How to transfer value to iframe? richard <noreply@example.com> - 2013-10-10 13:28 -0400
      Re: resolved?? Re: How to transfer value to iframe? Derek Turner <frderek@cesmail.net> - 2013-10-10 17:39 +0000
        Re: resolved?? Re: How to transfer value to iframe? richard <noreply@example.com> - 2013-10-10 15:47 -0400
          Re: resolved?? Re: How to transfer value to iframe? Denis McMahon <denismfmcmahon@gmail.com> - 2013-10-10 21:31 +0000
            Re: resolved?? Re: How to transfer value to iframe? richard <noreply@example.com> - 2013-10-10 19:45 -0400
              Re: resolved?? Re: How to transfer value to iframe? The Natural Philosopher <tnp@invalid.invalid> - 2013-10-11 01:45 +0100
              Re: resolved?? Re: How to transfer value to iframe? Evan Platt <evan@theobvious.espphotography.com.invalid> - 2013-10-11 08:17 -0700
              Re: resolved?? Re: How to transfer value to iframe? Denis McMahon <denismfmcmahon@gmail.com> - 2013-10-11 15:27 +0000
                Re: resolved?? Re: How to transfer value to iframe? Evan Platt <evan@theobvious.espphotography.com.invalid> - 2013-10-11 21:21 -0700
          Re: resolved?? Re: How to transfer value to iframe? David Robley <me@home.invalid> - 2013-10-11 11:43 +1030
    Re: resolved?? Re: How to transfer value to iframe? Norman Peelman <npeelman@cfl.rr.com> - 2013-10-10 18:13 -0400
      Re: resolved?? Re: How to transfer value to iframe? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2013-10-11 01:37 +0200
        Re: resolved?? Re: How to transfer value to iframe? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2013-10-11 01:51 +0200
      Re: resolved?? Re: How to transfer value to iframe? richard <noreply@example.com> - 2013-10-10 19:43 -0400
        Re: resolved?? Re: How to transfer value to iframe? Norman Peelman <npeelman@cfl.rr.com> - 2013-10-10 22:30 -0400
          Re: resolved?? Re: How to transfer value to iframe? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2013-10-11 13:05 +0200
          Re: resolved?? Re: How to transfer value to iframe? Denis McMahon <denismfmcmahon@gmail.com> - 2013-10-11 15:39 +0000
            Re: resolved?? Re: How to transfer value to iframe? Norman Peelman <npeelman@cfl.rr.com> - 2013-10-11 19:04 -0400

csiph-web