Question

For example i’ve a php script with this content:

<?php
$msg = addslashes("I'm a message. The what happened >:(");
echo "<script>alert($msg); return false;</script>";
?>

But the alert get broken by the last “(“. How can i solve this?

Answer 1

You should enclose alert parameter with quotes:

echo "<script>alert('$msg'); return false;</script>";

What your code outputs to the browser was:

<script>alert(The what happened >:(); return false;</script>

which is not a valid javascript, after putting the quotes, it becomes:

<script>alert('The what happened >:('); return false;</script>

which is valid javascript.