Question

I am creating a chunk of HTML/JavaScript with the below code:

$result = mysql_query("SELECT * FROM posts WHERE userid = '$user_id' ORDER BY DATE desc LIMIT 5")or die (mysql_error());

while ($row = mysql_fetch_array($result))
{

    $source = $row[source];
    $source = "'$source'";

    $p = $p.'<div id="red-div"><div id="smartass"><div id="image"><img src="thumbs/'.$user_image.'" /></div><div id="playsong"><a href="#" onclick="playsong(';
    $p = p.$source;
    $p = $p.'); return false;"><img src="play.png" width="16" height="16" border="0" /></a>'.$row[artist].' - '.$row[title].'</div></div><div id="post-comment">'.$row[comment].'</div><div id="post-date">'.$row[date].'</div></div><div id="dotted-line"></div>';

}

I then update a part of my page with the following code:

parent.document.getElementById('posts').innerHTML = '<?php echo $p; ?>';

For some reason no matter how I quote or enter $source into playsong(''); I loose the '' in playsong(); resulting in something like playsong(theSongVariable); and that of course does not work.

How do I properly quote or output the '' to make sure they stay in playsong('');?

Answer 1

edit: also, shouldn’t

$p = p.$source;

be

$p = $p.$source;

btw, don’t forget you can use the .= operator. like

$p .= $source;

edit2:
try outputting your $p for analysis using (will change < to &lt;

echo htmlspecialchars($p);

Edited to remove JS line. clearly not outputted from within a <?php ?> block. (should’ve had my coffee first)