Re: JS w PHP

Article View: pl.comp.lang.javascript

Article #50637

Back to pl.comp.lang.javascript Previous Next

#50637

From: porneL
Date: Sun, 13 Mar 2011 16:36

20 lines
1277 bytes

On Sun, 13 Mar 2011 14:55:17 -0000, aaaa <aaaa@aaaaaaaaaaaaaaaaaaa.com>  
wrote:
> chociaz ja bym proponowal raczej tak:
>
> ?>
> <script type="text/javascript">
> window.alert('<?php echo $text ?>');
> history.go(-1);
> </script>
> <?php

Nigdy nie wykonuj echo $zmienna. Bez escape'owania prosisz się o XSS albo  
przynajmniej złą interpretację niektórych wartości.

Do wstawiania rzeczy w <script> jedyny sensowny sposób to:

echo json_encode($zmienna);

-- 
regards, porneL

Technical Details

Message-ID: <op.vsai3qfgvq69rq@aimac.local>

Path: mbox-mo1.pugleaf.net!news-archive.icm.edu.pl!news.gazeta.pl!not-for-mail

References: <iliii3$89b$1@inews.gazeta.pl> <4d7cdad1$0$2448$65785112@news.neostrada.pl>

Show Full Headers

Complete Article Headers

Path: mbox-mo1.pugleaf.net!news-archive.icm.edu.pl!news.gazeta.pl!not-for-mail
From: porneL <niusy5@pornel.net>
Newsgroups: pl.comp.lang.javascript
Subject: Re: JS w PHP
Date: Sun, 13 Mar 2011 16:36:52 -0000
Organization: "Portal Gazeta.pl -> http://www.gazeta.pl"
Lines: 20
Message-ID: <op.vsai3qfgvq69rq@aimac.local>
References: <iliii3$89b$1@inews.gazeta.pl> <4d7cdad1$0$2448$65785112@news.neostrada.pl>
NNTP-Posting-Host: 96.95.187.81.in-addr.arpa
Mime-Version: 1.0
X-Trace: inews.gazeta.pl 1300034221 13606 81.187.95.96 (13 Mar 2011 16:37:01 GMT)
X-Complaints-To: usenet@agora.pl
NNTP-Posting-Date: Sun, 13 Mar 2011 16:37:01 +0000 (UTC)
X-User: pornelspam
User-Agent: Opera Mail/11.10 (MacIntel)
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reply to Parent Message