Hi All, this is probably really simple - I've posted it into the PHP forum in a thread I had going there, but it's probably more suited to being in here...

At the moment I'm using a javascript/jquery combo to load pages into a container div on my site - The script looks something like this:

HTML Code:

<script type="text/javascript">
function loadContent(elementSelector, sourceURL) {
$(""+elementSelector+"").load("http://www.website.com/test/"+sourceURL+"");
}
</script>

And a link looks like this:

HTML Code:

<a href="javascript:loadContent('.content', 'test3.php');">Video</a>

Now, because of the Apostrophe's in this and the Apostrophes needed in my PHP code for the database field names I'm getting syntax errors, for example:

PHP Code:

PHP Code:

<a href="javascript:loadContent('.content', 'video.php?video={$info['title']}'');">{$info['title']}</a> 


Does anyone know a way I can make this work?!

EDIT: I've just re-read my post and realised it's a bit vague.

What I now have is a dynamically generated page, that depending on the link that is clicked, passes the variables using $_GET to a new page.

I'm trying to open this page in my content DIV, but due to the apostrophe marks in the PHP array item names it's throwing up syntax errors/not working with the code...

Hopefully that makes it all a bit clearer in conjunction with the above!

I don't know PHP, but I'm almost positive you can escape the characters. Something like <a href="javascript:loadContent(\'.content\', \'video.php?video={$info[\'title\']}\'\');\">{$info[\'title\']}</a>

or something like that. This way when PHP renders it out it will see the apostrophe as an apostrophe.

At least I hope this is what it is.

Just given that a go and it's throwing up errors still!

What are the errors.. And what log file are the errors appearing..

Where is the rest of that line of PHP code? Should it be something like this:

PHP Code:

<a href="javascript:loadContent('.content', 'video.php?video=<?php echo $info['title']; ?>'); ?>"><?php echo $info['title']; ?></a>

or is the entire thing a string:

PHP Code:

"<a href=\"javascript:loadContent('.content', 'video.php?video={$info['title']}');\">{$info['title']}</a>" 


You can escape quotes using \

NullPointer, that last string worked perfectly, thanks. I think I must have had an extra quotation mark in there somewhere...

The full PHP is:

PHP Code:

<?php
$data = mysql_query("SELECT * FROM video WHERE type = 'Promo' ORDER BY added DESC") or die(mysql_error());
$i = 0; 
echo "<table class='griddy'>"; 
while($info = mysql_fetch_array( $data )) { 
    if($i % 3 === 0) echo "\n<tr>"; 
    echo "<td>"; 
    echo "<img class='still' src='../video/images/{$info['still']}' width='249px' height='148px' />";
    echo "<div class='title'><a href=\"javascript:loadContent('.content', 'video.php?video={$info['title']}');\">{$info['title']}</a></div>";
    echo "<div class='subtitle'>{$info['subtitle']}</div>";
    echo "</td>";
    if($i % 3 === 2) echo "</tr>"; 
    $i++; 
}
if($i % 3 > 0) echo "</tr>"; 
echo "</table>"; 
?>

Now I'm actually thinking of loading some of this into a separate page for SEO.

Are there any security measures I should think about when passing a variable in the URL?!

Originally Posted by hj8ag

NullPointer, that last string worked perfectly, thanks. I think I must have had an extra quotation mark in there somewhere...

The full PHP is:

PHP Code:

<?php
$data = mysql_query("SELECT * FROM video WHERE type = 'Promo' ORDER BY added DESC") or die(mysql_error());
$i = 0; //assign $i a starting value of 0
echo "<table class='griddy'>"; 
while($info = mysql_fetch_array( $data )) { 
    if($i % 3 === 0) echo "\n<tr>"; 
    echo "<td>"; 
    echo "<img class='still' src='../video/images/{$info['still']}' width='249px' height='148px' />";
    echo "<div class='title'><a href=\"javascript:loadContent('.content', 'video.php?video={$info['title']}');\">{$info['title']}</a></div>";
    echo "<div class='subtitle'>{$info['subtitle']}</div>";
    echo "</td>";
    if($i % 3 === 2) echo "</tr>"; 
    $i++; //increase $i by 1 ($i = $i + 1)
}
if($i % 3 > 0) echo "</tr>"; 
echo "</table>"; 
?>

Now I'm actually thinking of loading some of this into a separate page for SEO.

Are there any security measures I should think about when passing a variable in the URL?!

Yes,

If you put ANY of the data taken from the URL or from any kind of userinput you MUST clean the data before using it in things like databases.

You can use the mysql_real_escape_string and htmlentitys functions to help escape naughty hacking attemps.

Originally Posted by hj8ag

Are there any security measures I should think about when passing a variable in the URL?!

Just make sure you validate and sanitize it in video.php before doing anything with it (ie insert it into a query).

One way you can make your life easier when outputting a lot of text is to not bother trying to construct it all as strings:

PHP Code:

<?php 
$data = mysql_query("SELECT * FROM video WHERE type = 'Promo' ORDER BY added DESC") or die(mysql_error()); 
$i = 0; //assign $i a starting value of 0 
echo "<table class='griddy'>";  
while($info = mysql_fetch_array( $data )) {  
    if($i % 3 === 0) echo "\n<tr>";
?>    
<td>  
<img class='still' src='../video/images/<?php echo $info['still']; ?>' width='249px' height='148px' />
<div class='title'><a href=\"javascript:loadContent('.content', 'video.php?video=<?php echo $info['title']; ?>');\"><?php echo $info['title']; ?></a></div>
<div class='subtitle'><?php echo $info['subtitle']; ?></div>
</td>
<?php
    if($i % 3 === 2) echo "</tr>";  
    $i++; //increase $i by 1 ($i = $i + 1) 
} 
if($i % 3 > 0) echo "</tr>";  
echo "</table>";  
?>

If for whatever reason you want to capture it as a string rather than output it immediately you can use an output buffer http://us2.php.net/manual/en/function.ob-start.php

Tnx to all friend to sharing these codes . it might help me to create some new task nd project