Question

I have a form inside an iframe, and I’d like to prepopulate the form with certain data.

I’m trying to use php and javascript to accomplish this.

My code looks something like this :

   <script type="text/javascript">
      $(window).load(function() {
          document.getElementById('20988888993483').document.getElementById('input_13').value = <?=htmlspecialchars($_POST['input_13'])?>;
      }
  </script>

the id of the iframe is 20988888993483, and the ID of the input is input_13. I preload the value from previous form submission.

This code is strung together though, and I’m not quite sure what to do.

The error I get when I load the javascript is : uncaught syntaxerror unexpected end of input

UPDATE

Along with people’s suggestions, I’ve added quotes around the PHP string. In the wild, with the value being 5, the javascript looks like this — >

  <script type="text/javascript">
      $(window).load(function() {
        document.getElementById('20988888993483').document.getElementById('input_13').value = "5";
      }
  </script>

I still get the error though. Thoughts greatly appreciated

Answer 1

If the data in $_POST['input_13'] is a string (ie: not numeric or null), then you need to enclose it in quotes.

To handle the possibility of the magic quotes configuration setting being enabled:

$strValue = $_POST['input_13'];
if(get_magic_quotes_gpc()) {
    $strValue = stripslashes($strValue);
}

You then need to escape double-quotes only:

$strValue = addcslashes($strValue, '"');

The string is now safe to insert into the JavaScript. Also note that there’s no need to use htmlspecialchars(), since you’re setting the value property of the element, not the innerHTML property.

document.getElementById('20988888993483').document.getElementById('input_13').value = "<?= $strValue ?>";

Edit

Alternatively, if you’re running PHP >= 5.2.0, then the best solution is to use json_encode():

$strValue = $_POST['input_13'];
if(get_magic_quotes_gpc()) {
    $strValue = stripslashes($strValue);
}

document.getElementById('20988888993483').document.getElementById('input_13').value = <?= json_encode($strValue) ?>;