escaping strings to php

php html escaping

[Matthew1980]

Hello people of webmaster world,

In this code below I have got the html stored into an array, so its effectively a string, and i know that to have php into strings you have to escape it by the use of concatination. My problem is I have added a constant 'HTACCESS' into the mix, which is fed by a database call to turn it into a switch - however the constant is instructing a ternary option which is either page friendly urls or query string urls has played up. By adding the $_GET['id'] its al gone a bit pear shaped.

Can anyone see something that I have done wrong as im getting tired of staring at my laptop, and would rather like to turn it off!

Thanks in advance,

Matthew

As you can see, the code would be best viewed on one line!

encl:-

$images[] = "<a href=\"gallery_images/".$display_img['filename']."\" class=\"highslide\" onclick=\"return hs.expand(this, {captionId: 'caption".$counter."'})\"><img src=\"thumbs/".$display_img['filename']."\" class=\"img_cont\" alt=\"Highslide JS\" title=\"Click to enlarge\" /></a><div class=\"highslide-caption\" id=\"caption".$counter."\">".$display_img['title']."<br/><a href=\".(HTACCESS ? '"index.php?cmd=add-comment&amp;id=".$_GET['id'].""':'"add-comment/".$_GET['id']."/index.html"').\">Add comment>></a></div>"."\n";

[eelixduppy]

Are you getting any errors from this line? If so it might be able to help you debug the line.

Here though it looks like you are missing a quote (which I added):

<a href=\"".(HTACCESS ?

[idfer]

You got a double quoting thing going in your inline conditional, and you need to end the string before it and restart it afterwards. Change it to this and you can turn off your laptop:

$images[] = "blah blah .. <a href=\"".(HTACCESS ? "index.php?cmd=add-comment&amp;id=".$_GET['id'] : "add-comment/".$_GET['id']."/index.html")."\">blah blah";

Personally, i try to stay away from inline conditionals as much as possible cause they're hard to maintain, i'd rather do this:

if(HTACCESS)
 $commentURL = 'index.php?cmd=add-comment&id='.$_GET['id'];
else
 $commentURL = 'add-comment/'.$_GET['id'].'/index.html';
$images[] = "blah blah .. <a href=\"".$commentURL."\">blah blah";

[Matthew1980]

Hi Eelixduppy,

I was suprised then, pressed refresh and had a reply!

Just tried that suggestion, and the parse error i get is this:-

Parse error: parse error, unexpected T_STRING

I also tried it without the $_GET['id'] part in, and it functions correctly, so my problem is with how i escape that from the string to php - at least thats what I *think* it could be.

Failing that I will just have to engineer another sollution that negates the use of a string.

Thanks for the help.

Cheers,

Matthew

[Matthew1980]

Hi Idfer,

Well thats what a fresh pair of eyes can do!

Works fine now I changed that code - I see where i went wrong too - i was already in php mode, no need to escape to something I was already in!

I will now go and put my tea on and watch the telly. Also I looked at your suggestion, and what I will do is the next time I update/maintain I will try doing similar to your suggestion.

Cheers for the help,

Matthew

[eelixduppy]

Glad you got it sorted. I guess I should have kept looking through the code after I found the first mistake. :)

In any case, it will make it a bit easier to write and follow if you use single quotes around string literals instead of double quotes, especially when you know there are going to be double quotes in the string so you don't have to escape them. For example:

$images[] = '<a href="gallery_images/' . $display_img['filename'] . '" class="highslide"...

[Matthew1980]

Hi Eelixduppy,

See I thought as it was 'bad-practice' to just use single quotes for things like that. I was always told double quotes - but if it works and throws no html tidy errors - never mind eh?

Cheers once again!

Matthew