Question

I can’t change the value of the text field (with the id “code”) to the PHP value (stored in the variable $code):

$code = $_POST['code'];
echo "<script language='javascript'>
document.getElementById('code').value = $code </script>";

I also tried '$code' and "$code","..." + "%code + "...", but neither helped.
What am I doing wrong?

Answer 1

Does $code contain a string? If so you’ll need to quote it.

e.g. if $code equals “my test string”, the Javascript will be output like:

$code = $_POST['code'];
echo "<script language='javascript'>
document.getElementById('code').value = my test string </script>";

which is invalid Javascript.

You need to:

$code = str_replace("'", "\'", $_POST['code']);
echo "<script language='javascript'>
document.getElementById('code').value = '$code' </script>";

I would also do:

$code = str_replace("'", "\'", htmlspecialchars($_POST['code']));

htmlspecialchars quotes HTML characters to prevent XSS attacks.