Question

'<textarea name="textChange" class="signatureChangeText" cols="100" rows="4">'
+ SOME VARIABLE FULL OF TEXT
+ '</textarea>'

The preceding is just part of a simple string that I am using with a change to an innerHTML attribute of a div inside of a javascript function. That “SOME VARIABLE FULL OF TEXT” is the problem, if that variable contains a string that contains javascript parseable data (data to interpret) such as addition symbols or quotations, etc – the script breaks. How do I avoid this? By the way, the variable is dynamic to each user, it is filled by a php echo statement and so inserted on the backend into the javascript. I’ve thought of how to accomplish this in another way but none are coming the mind. The data is from a database, I pull it with PHP and I need to insert it into this textarea that is dynamically created and inserted into the page based on a user command via innerHTML. Thanks for any help.

Edit: requested context function:

else if (theChange == 'signature') {
        document.getElementById('userPanelChangeBox').innerHTML = 
        '<form action="tinUser_processor.php" method="post">'
        +'Signatures cannot contain any markup (HTML, BBCode, etc) or styling and can only be 4 lines<br />'
        +'Enter your new signature:<br /><br />'
        +'<textarea name="textChange" class="signatureChangeText" cols="100" rows="4">'
        +'<?php echo $userInfo['signature']; ?>'+'</textarea><br /><br />'
        +'<input type="hidden" value="signature" name="typeChange" />'
        +'<input type="submit" value="Submit Change" name="submitter" /></form>';
        }

Answer 1

Seems like you would need to escape HTML and single quotes. You can use PHP’s built-in htmlentities function to do this, like so:

<?php echo htmlentities($userInfo['signature'], ENT_QUOTES); ?>