Question

I’ve seen numerous posts on how to do this either saying to use rawurlencode in the php and decodeURIComponent in javascript or just use json_encode. Neither work for me. Hoping someone can see what I’m doing wrong:

I have an html button like this:

<button id="editbutton" onClick='edit(this, "<?php echo htmlentities($_SERVER['REQUEST_URI']); ?>", "<?php echo $result_cameras[$i]["camera_type"]; ?>", "<?php echo rawurlencode($result_cameras[$i]["camera_name"]); ?>")'>Edit</button>

I pass that into the javascript edit button:

var edit = function(t, to, cameratype, cameraname, cameraquality, camerahash, camerastatus, emailnotice, camerasensitivity, axisuser, axispass, axisip, axisport)
{

if (mydiv.find("form").length) {
    mydiv.show();
} else {
    // fields
    var $myform = $("<form id='EditCameraForm' name='' method='post' action='" + to + "'></form>");
    var $myfieldset = $("<fieldset><legend>Edit camera settings</legend></fieldset>");
    var $myinput = $('<input/>').attr('type','hidden').attr('name','camera_type').val(cameratype);
    var $mylabel = $("<label for='CameraName'>Camera name:&nbsp;</label>");
    var $myinput2 = js('<input/>').attr('size','25').attr('name','camera_name').attr('id','CameraName').val(decodeURIComponent(cameraname));
    $myform.append($myinput, $mylabel, $myinput2);
...
}
...
}

I’ve tried using rawurlencode/decodeURIComponent as above and when I hit the edit button if the camera name is called: a"a (just testing the quotes) I get a"a. Backslashes such as a\b just returns some weird characters back.

If I try:

<?php echo json_encode($result_cameras[$i]["camera_name"]); ?> 

and don’t put anything in the javascript code I get this error:

missing ) after argument list

edit(this, "/dashboard", "WEBCAM", ""a"a"", "0", "3dd10c49784e2207de1e1932958bfb...
Where it is pointing to the “”a”a””.

Any suggestions?

Answer 1

You are in effect outputting a javascript string literal, so using htmlentities is not the correct thing to do. What you need instead is addslashes:

<?php echo addslashes($_SERVER['REQUEST_URI']); ?>

Edit: It goes without saying that you also need to do this for the other two strings you are echoing.

The reason this is correct is that the escape sequences for Javascript string literals are compatible with what addslashes does, if you ignore the fact that addslashes also escapes the “null” character. However, there’s no way that character will be part of your URL so there is a perfect match between what addslashes does and what Javascript expects from its string literals.

For completeness I should mention that an appropriate usage of htmlentities is to process text that is being sent as part of HTML content; even then, htmlspecialchars (which performs a small subset of the work of htmlentities) is almost always the better fit.