Path: csiph.com!usenet.pasdenom.info!weretis.net!feeder4.news.weretis.net!newsreader4.netcologne.de!news.netcologne.de!newsfeed.arcor.de!newsspool3.arcor-online.net!news.arcor.de.POSTED!not-for-mail
Content-Type: text/plain; charset="UTF-8"
Message-ID: <3866294.L8KrQWI3Da@PointedEars.de>
From: Thomas 'PointedEars' Lahn <PointedEars@web.de>
Reply-To: Thomas 'PointedEars' Lahn <php@PointedEars.de>
Organization: PointedEars Software (PES)
Date: Fri, 11 Oct 2013 01:37:26 +0200
User-Agent: KNode/4.10.5
Content-Transfer-Encoding: 8Bit
X-Face: %i>XG-yXR'\"2P/C_aO%~;2o~?g0pPKmbOw^=NT`tprDEf++D.m7"}HW6.#=U:?2GGctkL,f89@H46O$ASoW&?s}.k+&.<b';Md8`dH6iqhT)6C^.Px|[=M@7=Ik[_w<%n1Up"LPQNu2m8|L!/3iby{-]A+#YE}Kl{Cw$\U!kD%K}\2jz"QQP6Uqr],./"?;=4v
Face: iVBORw0KGgoAAAANSUhEUgAAADAAAAAwBAMAAAClLOS0AAAAGFBMVEXTxa4RFk5dUWANED8PFEfy7+MGBiW+n3ZNF/QuAAACaElEQVQ4jVXUwVOcMBQG8Dc7Rc4PUntdWV2uxjDpGaGeozOp1woar4jd5t/v9wLstMwsA/ntlxdCAgUc1hjTc9/JCZfGoo3wG3HdmdAWrIJRHe7GM/TmpY5VFefuVcAkkPbLIaN8rmPmjloyZxgyR3GuJ4K0AGtJ2htz8o7yqikm759fldQXaMpbDzjKAG+8v+AugVTOPO5DOjLvGtUYQwh0CPjnVMyGd+8/GfUB5nLKJDD2aLDh5HYyMDJGDwQIo2ZmZcKbowNmAdB/AzyFhrmF2MHRb0QJJfaAnwGB6orZhoykLzJtGwF/xpYxI1dswomiUj3gTuAIqCn/4C7cULwGNBtwMTk3Y4LfKB5YUaOKBKYtpplm7u0vip8tU1NWWyI/7XdcSuIDoMt6rVHMWT0DbjHPGqDqZVSa6zleLcUTcIKLoMv3ueJluALtAo9B302zPPlrtiVScRdCjXvVh3e3JpYa/jjkuC9N+LrBMlz/eAN4eQijX2EdLo6c5tGGHwLyHFtXk89dDGHwCVhG9T0S/j55AhRZgkMCmUQXJ49TnS1wnQDvw0eAh9ICeMmEFbCnPMFzjAvsWoEWEFdYEx+S0MoUZ1gT1wId8+AF3Bl2OoEu906AUHx5VLw/gXYg/x84loOah/2UYNrgiwSwGO7RfUzVBbx/kgpckumGOi6QirtD6gkLTitbnxNol47S2jVc2vsN5kPqaAHT8uUdAJM4v/DanjYOwmUjWznGfwB7sGtAtor5BgofDuzaRj4kSQAqDakTsKORa3Q3xKi3gE1fhl71KRMqrdZ2AWNNg/YOhQyrVBnb+i+nEg4bsDA+egAAAABJRU5ErkJggg==
Subject: Re: resolved?? Re: How to transfer value to iframe?
Newsgroups: comp.lang.php
References: <12cqbhii4rehb.1tf3fbhsnvt9o$.dlg@40tude.net> <orlpb7ptvlye.o9v9q8t427lk.dlg@40tude.net> <l378qb$r9n$1@dont-email.me>
MIME-Version: 1.0
Lines: 63
NNTP-Posting-Date: 11 Oct 2013 01:37:31 CEST
NNTP-Posting-Host: e56fe12b.newsspool2.arcor-online.net
X-Trace: DXC=Mo>7<V4O9Io^Y=RbYBPl4`A9EHlD;3Ycb4Fo<]lROoRa8kF<OcfhCOk9oB1OC=45TlDZm8W4\YJNlb@mF9jNikde@hR_<@5eU4kCi7FYXM8?Xj
X-Complaints-To: usenet-abuse@arcor.de
Xref: csiph.com comp.lang.php:11356

Norman Peelman wrote:

> On 10/10/2013 01:01 PM, richard wrote:
>> On Wed, 9 Oct 2013 22:32:22 -0400, richard wrote:
>>> http://mroldies.net/200/audiox.php
>>>
>>> First, the sound will work only in firefox.
>>> So don't go bashing me for that.
>>
>>
>> <?php
>> $number=$numbers[0];
>> echo '<iframe id="x1" src="audiox1.php?asong='.$number.'"
>> name="alpha"></iframe>';
>> ?>
>>
>> At least the first number is now displayed.
> 
> echo "<iframe id=x1
> src='audiox1.php?asong=$number&name=$alpha'></iframe>";

The safe syntax is

  echo "<iframe id=x1 
src='audiox1.php?asong={$number}&name={$alpha}'></iframe>";
 
> No need to quote the *values*, they are sent as text.

Utter nonsense.  Depending on the version of HTML and the attribute value, 
attribute values MUST be quoted.  The safe approach is to *always* quote 
attribute values, it certainly is when attribute values or parts of those 
are generated like here.  Since double-quoting is more common than single-
quoting, double-quoting as it was done by the OP actually is the safe 
approach.

You might have misread the original code, which is actually equivalent to

  echo '<iframe id="x1" src="audiox1.php?asong='
    . $number
    . '" name="alpha"></iframe>';

if we assume that the line-break after “$number.'"” was accidental 
originally or was inserted when you quoted the original code.

In particular, in your code the value of $alpha must be *URI-encoded* or the 
URI-reference that is the attribute value is invalid or the entire HTML 
fragment could become invalid (or code-injected) if $alpha contains space or 
special characters.  Other generated attribute values, unless it is certain 
that code injection is impossible (for example with int values), SHOULD be 
htmlspecialchars()'d.

> Not sure what you're doing with -alpha-, I assume it is a variable as
> well...

Does it look like one?  RTFM.


PointedEars
-- 
> If you get a bunch of authors […] that state the same "best practices"
> in any programming language, then you can bet who is wrong or right...
Not with javascript. Nonsense propagates like wildfire in this field.
  -- Richard Cornford, comp.lang.javascript, 2011-11-14