Question

I have a situation with a quotation mark. If I type in a piece of text (a question) which has a single quote such as for example:

What is Mr Green’s dog called?

Then I suddenly receive an error stating:

Syntax error: missing ) after argument list

Then it displays this in the console:

parent.addwindow(‘What is Mr Green’s dog called?, ‘5’, ‘1’, ‘A-D’,
‘Single’, ‘A’);

My question is that can I change anything in the code below to allow single quotations for the question? Also some of my columns above are actually int data types, so how can I remove the single quotes around them? Finally is there any other characters that could cause a problem in future? (Double quotes, full stops, commas etc)

I don’t quite know where the problem is so I have posted the main code so you can find where problem lies. (If you know where the problem lies, please tell me where it lies so I can delete all code except for the relevant code so that I can reduce the code for future users to see):

<script type="text/javascript">

function trim (el) {
    el.value = el.value.
       replace (/(^\s*)|(\s*$)/gi, ""). // removes leading and trailing spaces
       replace (/[ ]{2,}/gi," ").       // replaces multiple spaces with one space 
       replace (/\n +/,"\n");           // Removes spaces after newlines
    return;
}


</script>

<?php

  function make_values_referenced (&$arr) { 
    // The fact the you even need to do this is exactly why I recommend PDO_mysql
    // over MySQLi
    $refs = array(); 
    foreach ($arr as $key => $value) {
      $refs[$key] = &$arr[$key];
    }
    return $refs;
  }

  // Determine whether to do database query
  // Using preg_split() prevents empty search terms
  if (!empty($_GET['searchQuestion']) && ($terms = preg_split('/\s+/', $_GET['questioncontent'], -1, PREG_SPLIT_NO_EMPTY))) {

    // A temp array to hold the terms after they have been constructed
    $termArray = array();

    // We'll need to use this a few times so we'll cache it
    $numTerms = count($terms);

    // Loop $terms and create an array of strings that can be used with LIKE clauses
    foreach ($terms as $term) {
      // The str_replace() allows users to include literal % and _ in the search terms
      $termArray[] = '%'.str_replace(array('%', '_'), array('\%', '\_'), $term).'%';
    }

    // Build the query
    $questionquery = "
SELECT DISTINCT q.QuestionContent, o.OptionType, q.NoofAnswers, GROUP_CONCAT(an.Answer ORDER BY an.Answer SEPARATOR ' ') AS Answer, r.ReplyType, 
       q.QuestionMarks 
  FROM Answer an 
  INNER JOIN Question q ON q.AnswerId = an.AnswerId
  JOIN Reply r ON q.ReplyId = r.ReplyId 
  JOIN Option_Table o ON q.OptionId = o.OptionId 
      WHERE ".implode(" AND ", array_fill(0, $numTerms, "q.QuestionContent LIKE ?"))."
      GROUP BY q.QuestionId, q.SessionId
      ORDER BY ".implode(", ", array_fill(0, $numTerms, "IF(q.QuestionContent LIKE ?, 1, 0) DESC"))."
    ";

    // Make the referenced array
    $referencedArray = make_values_referenced(array_merge(
      array(str_repeat("ss", $numTerms)), // types
      $termArray,                         // where
      $termArray                          // order by
    ));

    // ...or die() is evil in production but I shall assume we are debuggin so I won't complain
    if (!$stmt = $mysqli->prepare($questionquery)) {
      die("Error preparing statement: $mysqli->error"); 
    }

    // Bind parameters
    if (!call_user_func_array(array($stmt, 'bind_param'), make_values_referenced($referencedArray))) {
      die("Error binding parameters: $stmt->error"); 
    }

    // Execute
    if (!$stmt->execute()) {
      die("Error executing statement: $stmt->error"); 
    }

    // This will hold the search results
    $searchResults = array();
    $searchOption = array();
    $searchNoofAnswers = array();
    $searchAnswer = array();
    $searchReply = array();
    $searchMarks = array();

    // Fetch the results into an array
    if (!$stmt->num_rows()) {
      $stmt->bind_result($dbQuestionContent,$dbOptionType,$dbNoofAnswers,$dbAnswer,$dbReplyType,$dbQuestionMarks); 
      while ($stmt->fetch()) {
        $searchResults[] = $dbQuestionContent;
        $searchOption[] = $dbOptionType;
        $searchNoofAnswers[] = $dbNoofAnswers;
        $searchAnswer[] = $dbAnswer;
        $searchReply[] = $dbReplyType;
        $searchMarks[] = $dbQuestionMarks;
      }
    }

  }

  $inputValue = !empty($terms) ? htmlspecialchars(implode(' ', $terms)) : '';


if (isset($_GET['searchQuestion'])) {

  // If $terms is not empty we did a query
  if (!empty($terms)) {

      $questionnum = sizeof($searchResults);

    // If $searchResults is not empty we got results
    if (!empty($searchResults)) {
      echo "<p>Your Search: '$inputValue'</p>";  
      echo"<p>Number of Questions Shown from the Search: <strong>$questionnum</strong></p>";
      echo "<table border='1' id='resulttbl'>
      <tr>
      <th class='questionth'>Question</th>
      <th class='optiontypeth'>Option Type</th>
      <th class='noofanswersth'>Number of <br/> Answers</th>
      <th class='answerth'>Answer</th>
      <th class='noofrepliesth'>Number of <br/> Replies</th>
      <th class='noofmarksth'>Number of <br/> Marks</th>
      </tr>";
      foreach ($searchResults as $key=>$question) {
        echo '<tr class="questiontd"><td>'.htmlspecialchars($question).'</td>';
        echo '<td class="optiontypetd">'.htmlspecialchars($searchOption[$key]).'</td>';
        echo '<td class="noofanswerstd">'.htmlspecialchars($searchNoofAnswers[$key]).'</td>';
        echo '<td class="answertd">'.htmlspecialchars($searchAnswer[$key]).'</td>';
        echo '<td class="noofrepliestd">'.htmlspecialchars($searchReply[$key]).'</td>';
        echo '<td class="noofmarkstd">'.htmlspecialchars($searchMarks[$key]).'</td>';
        echo "<td class='addtd'><button type='button' class='add' onclick=\"parent.addwindow('$question','$searchMarks[$key]','$searchNoofAnswers[$key]','$searchOption[$key]','$searchReply[$key]','$searchAnswer[$key]');\">Add</button></td></tr>";
}
      echo "</table>";
    } 

}
?>

Answer 1

If you’re trying to write out data into a JavaScript variable using PHP, your best bet is to json_encode() it to get it into the proper JS format before writing it out.