Problem with nested quotes

[HerrVredy]

Hi,

I got a question about nested quotes. At least, that's what I think the problem is. I'm trying to solve this problem a few days now, but I can't find a sollution.

I'm using a combination of javascript and php. I want to get a kind of dropdown menu where the settings of a user are shown. The content of this dropdown menu is generated by php (settings.php). It contains a table, text and a few images.
In my file I've written this code:

[tab][green]<div id="settings" onmouseover="show_settings(event,'<? include("settings.php");?>')" onmouseout="delay_hide_settings()">[/green]

The settings.php-file generates text like:

[tab][green]<table width=\"320\" border=\"0\" cellspacing=\"0\" cellpadding=\"0\">
[tab] <tr>
[tab] <td>sort</td>
[tab] <td><img src=\"./images/arrow_sort.gif\">
[tab] <a href=\"index.php?order_by=name&order_how=DESC\" class=\"controlpanel\">alphabetical</a>
[tab] </td>
[tab] </tr>
[tab] <tr><td>...</td></tr>
[tab]</table>[/green]

The javascript-function show_settings() places this text in some kind of dropdown menu.
I've tried to backslash, double backslash ",',... the text php generates, but every time he breaks out on 'sort'.

When I look to the source code of my generated html-file in IE, I get this:
[tab][green]<div id="settings" onmouseover="show_settings(event,'<table width=\"320\" border=\"0\" cellspacing=\"0\" cellpadding=\"0\">
[tab] <tr>
[tab] <td>sort</td>
[tab] <td><img src=\"./images/arrow_sort.gif\">
[tab] <a href=\"index.php?order_by=name&order_how=DESC\" class=\"controlpanel\">alphabetical</a>
[tab] </td>
[tab] </tr>
[tab] <tr><td>...</td></tr>
[tab]</table>
[tab]')" onmouseout="delay_hide_settings()">[/green]

Can anybody give me a clue of what I'm doing wrong?

Thanks a lot,

Herr Vredy

 

[mmerlinn]

I have no idea what your problem is or how to solve it as I don't understand your code.

However, in your generated HTML code, I did notice something that could be causing you problems. In your first line you have ELEVEN (11) double quotes and ONE (1) single quote. By definition quotes work in pairs so an ODD number of quotes should throw an error somewhere.

Your last line has THREE (3) double quotes, so I assume that the first one is paired with the third one in the first line. But, I do not see another single quote anywhere to pair with the one in the first line. So, I would be looking for a missing single quote somewhere that would be throwing an error.


mmerlinn

"Political correctness is the BADGE of a COWARD!"

 

[feherke]

Hi

Your problem is PHP. It would be JavaScript only if the PHP script would generate correct HTML source for the page.

Please repost in forum434. And while doing that, post something from the source code of settings.php too.

Feherke.

http://rootshell.be/~feherke/

 

[HerrVredy]

Thanks for your responses, but the problem is not php.

I will simplify the problem:
my code is this (I removed everything of php):
[green]
[tab]<div id="settings" onmouseover="show_settings(event,'<table width=\"320\" border=\"0\" cellspacing=\"0\" cellpadding=\"0\"><tr><td>sort</td><td><img src=\"./images/arrow_sort.gif\"><a href=\"index.php?order_by=name&order_how=DESC\" class=\"controlpanel\">alphabetical</a></td></tr><tr><td>...</td></tr></table>')">[/green]

The function show_settings(event,text) places this text in some kind of dropdown menu. When the variable text is just some stupid text like 'test', he does the trick, but when text is something like above (a table and images), he gives an error that the code isn't correct.

I think it is a stupid problem, but I can't find the solution. Can somebod help me?

Thanks,

Frederik

 

[bokula]

Maybe the problem is in show_settings() function. Can you post it?

 

[feherke]

Hi

Oops, you are right Frederik. I misunderstood the problem.

In your PHP code do not escape the double quotes ( " ) but replace them with HTML entity :

[gray]<!-- incorrect -->[/gray]
<div onmouseover="alert('a[red]"[/red]b')">x</div>

[gray]<!-- correct -->[/gray]
<div onmouseover="alert('a[red]&quot;[/red]b')">x</div>

Feherke.

http://rootshell.be/~feherke/

 

[feherke]

Hi

Posted to fast.

<!-- also incorrect -->
<div onmouseover="alert('a[red]\"[/red]b')">x</div>

Feherke.

http://rootshell.be/~feherke/

 

[adam0101]

To expand on Feherke's answer, if you start the HTML attribute with a double quote, you cannot escape a double quote within the attribute with a backslash. You have to HTML encode it to &quot;.

Likewise, if you start the HTML attribute with a single quote, you cannot escape a single quote within the attribute with a backslash. You have to HTML encode it to &#39;.

The alternative is to quote your attribute differently. Here's a test...

[b]Double quotes in the alert[/b]<br>
<a href="javascript:alert('This is a \"test\"')">[red]Wrong[/red]</a><br>
<a href="javascript:alert('This is a &quot;test&quot;')">[green]Right[/green], HTML encoded quotes</a><br>
<a href='javascript:alert("This is a \"test\"")'>[green]Right[/green], uses ' for attribute instead.</a><br>

[b]Single quotes in the alert[/b]<br>
<a href='javascript:alert("This is a \'test\'")'>[red]Wrong[/red]</a><br>
<a href='javascript:alert("This is a &#39;test&#39;")'>[green]Right[/green], HTML encoded quotes</a><br>
<a href="javascript:alert('This is a \'test\')'>[green]Right[/green], uses " for attribute instead</a><br>

Adam

http://adameslinger.blogspot.com/

 

[adam0101]

I mistyped that last line, it should be

<a href="javascript:alert('This is a \'test\'[b]')"[/b]>Right, uses " for attribute instead</a><br>

Adam

http://adameslinger.blogspot.com/

 

[HerrVredy]

Thank you guys! It works now!