Question

I have code like this:

<?php
echo '<script type="text/javascript">';
echo 'var out="'.$txt.'";';
echo '</script>';
?>

Where $txt is a PHP variable that can contain newlines like this:

line1
 line2 hello world

Which would end up like this:

var out="line1
 line2 hello world";

Which will cause a Javascript error, of course.

What is the best way to handle this? The out variable will be used in a HTML textarea, so I don’t think it can be parsed into <br>

Answer 1

$txt = str_replace( array( "\n", "\r" ), array( "\\n", "\\r" ), $txt );

should replace newlines. Don’t do it this way.

This is a naïve implementation of string escaping for JavaScript. As you’re actually trying to format a string for use in JavaScript, a much better solution would be to use json_encode:

$txt = json_encode($txt);
echo "<script>var out={$txt};</script>";

json_encode will correctly escape special characters in strings, such as quotes, tabs, form feeds, and other special unicode characters. It will also perform all the correct escaping for converting objects, arrays, numbers, and booleans.