在 PHP 中转义字符串以供 JavaScript 使用

Question

我通过 AJAX 接收一些代码并像这样处理它：

$verifiedSubject = addslashes(htmlentities($_REQUEST['subject']));
$verifiedBody = addslashes(htmlentities($_REQUEST['body']));
$verifiedAttachment1 = addslashes(htmlentities($_REQUEST['attachment1']));
$verifiedAttachment2 = addslashes(htmlentities($_REQUEST['attachment2']));

echo '<div id="subject" style="text-decoration: underline; cursor:pointer; display: inline; margin-bottom: 2%;" onclick=\'readmore("'.json_encode($verifiedSubject).'", "'.json_encode($verifiedBody).'", "'.json_encode($verifiedAttachment1).'", "'.json_encode($verifiedAttachment2).'")\'>';
echo $_REQUEST['subject'];
echo '</div>';

在上面的代码中，我尝试将任何 HTML 代码转换为实体，添加斜杠以转义单引号和双引号，然后 json_encode() 它供 JavaScript 在 onclick 函数中处理。

然而，当点击文本启动onclick我得到这个错误：

Uncaught SyntaxError: missing ) after argument list

我尝试了各种 PHP 函数来尝试正确转义该字符串，但似乎没有任何效果。谁能帮帮我？

页面来源更新：

<script>
var date = "Monday, November 16th, 2015 Announcements";
formatAnnouncement( '55', 
                    'Hi',
                    '<b  rgb(0, 0, 0); font-family: Arial, Helvetica, sans; font-size: 11px; line-height: 14px; text-align: justify;\">Lorem Ipsum</b><span  rgb(0, 0, 0); font-family: Arial, Helvetica, sans; font-size: 11px; line-height: 14px; text-align: justify;\">&nbsp;is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry\'s standard dummy text ever since the 1500s, when an unknown printer took a galley of type and scrambled it to make a type specimen book. It has survived not only five centuries, but also the leap into electronic typesetting, remaining essentially unchanged. It was popularised in the 1960s with the release of Letraset sheets containing Lorem Ipsum passages, and more recently with desktop publishing software like Aldus PageMaker including versions of Lorem Ipsum.</span>',
                    '0',
                    '',
                    '',
                    '******',
                    '2015-11-16 16:53:23',
                    date
                    );
</script>

Answer 1

你做错了。 json_encode() 做所有你需要的事情，只需将结果字符串用作可分配的“值”。例如

<?php

$foo = 'bar';
?>

<script>
    var test1 = <?php echo json_encode($foo); ?>;   // this works
    var test2 = "<?php echo json_encode($foo); ?>; // this doesn't

你最终会得到的是：

var test1 = "bar";
var test2 = ""bar"";  //syntax error - two empty strings with undefined var between them

所以你的代码应该有：

echo '<div id="subject" style="text-decoration: underline;
   cursor:pointer; display: inline; margin-bottom: 2%;"
  onclick=\'readmore('.json_encode($verifiedSubject). ', '. 
                      ^--no "                          ^-^--ditto 
  etc...

不需要添加斜杠，因为 json 会转义将您的值转换为“安全”javascript 字符串表示所需的所有内容。但是，由于您将此 json 文本嵌入到 html onclick 中，因此很可能需要 htmlentities，以防止 " 字符“突破”html。

Answer 2

看起来它回显的结果有太多引号。试试这个：

echo '<div id="subject" style="text-decoration: underline; cursor:pointer; display: inline; margin-bottom: 2%;" onclick=\'readmore('.json_encode($verifiedSubject).', '.json_encode($verifiedBody).', '.json_encode($verifiedAttachment1).', '.json_encode($verifiedAttachment2).')\'>';
echo $_REQUEST['subject'];
echo '</div>';