1

how to proper escape echo in php, so I am transfering a php variable to javascript using this code

<script type="text/javascript">
  var sel = "<?php echo $result[0]; ?>";
</script>

It seems to be good practice to escape the "echo" statments, whats the best way of doing so.

Just to put in context, I am trying to put a free plugin on wordpress, first time doing so and it seems that the variables need to be escaped when echo'd.

2
  • 1
    It depends on how you intend to use the value, and where it came from. Like there, escaping "s would certainly be useful - but with backslashes or HTML entities depends on the use-case - but beyond that there's not enough context to say how else you might want to escape it. For transferring data from PHP for use in JS, generally best practice is to json_encode() it into wp_add_inline_script() data
    – bosco
    Commented Aug 27, 2022 at 17:48
  • always have this difficulty transfering php to js, gonna try the wp_add_inline_script(), regard to the variable, it comes from the html form, it has text and it is to change using js the value of other input in the same form. not very needing escaping, however wp was asking me to do so Commented Aug 27, 2022 at 20:32

1 Answer 1

1

Whether and how something should be escaped is largely dependent on where the data came from and how it will be used. It's primary function is to prevent data from being interpreted as a part of the code or mechanism which the data will be contained in - we don't want a value used in a URL's querystring containing &s to be interpreted as additional parameters, for instance. Or data which will be inserted into an HTML attribute to contain quotations that would effectively enable it to potentially close the attribute quotation and have it's contents interpreted as markup.

In this case where you're embedding the value in a JS string, all we can say for sure is that if the value has any chance of containing a ", we want to escape those quotations such that the data could not execute arbitrary JavaScript. WordPress's esc_js() may be a good escaping selection here.

When possible, it is recommended that you transfer data from PHP to JS using a wp_add_inline_script() call. We can mimic the functionality of wp_localize_script() by json_encoding() an associative array of data into a JSON object (which might not be necessary if you only have one/a few values, or the script for which you're inlining data depends on specific globals/variables):

function wpse408964_enqueue_scripts() {
  $result = //...;

  wp_enqueue_script( 'my-static-script', plugins_url( 'js/static.js', __FILE__ ) );
  wp_add_inline_script(
    'my-static-script',
    'const MYDATA = ' . json_encode( array(
      'sel' => esc_js( $result[0] )
    ) ),
    'before'
  );
}

However, this may not be possible depending on your specific use-case.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.