Having trouble passing text from MySQL to a Javascript function using PHP

Question

So here's the problem. I have data in a MySQL DB as text. The data is inserted via mysql_real_escape_string. I have no problem with the data being displayed to the user.

At some point I want to pass this data into a javascript function called foo.

// This is a PHP block of code
// $someText is text retrieved from the database

echo "<img src=someimage.gif onclick=\"foo('{$someText}')\">";

If the data in $someText has line breaks in it like:

Line 1
Line 2
Line 3

The javascript breaks because the html output is

<img src=someimage.gif onclick="foo('line1
line2
line3')">

So the question is, how can I pass $someText to my javascript foo function while preserving line breaks and carriage returns but not breaking the code?

===========================================================================================

After using json like this:

echo "<img src=someimage.gif onclick=\"foo($newData)\">";

It is outputting HTML like this:

onclick="foo("line 1<br \/>\r\nline 2");">

Which displays the image followed by \r\nline 2");">

Answer 1

json_encode() is the way to go:

$json = json_encode($someText); # this creates valid JS
$safe = HtmlSpecialChars($json); # this allows it to be used in an HTML attribute
echo "<img src=someimage.gif onclick=\"foo($safe)\">";

You can see a demo here: http://codepad.org/TK45YErZ

Answer 2

If I'm not interpreting badly you may do this:

// This is a PHP block of code
// $someText is text retrieved from the database

echo "<img src=someimage.gif onclick=\"foo('{".trim( preg_replace( '/\s+/', ' ',$someText ) )."}')\">";

Answer 3

You'll save yourself a lot of headaches by pulling the JavaScript out of the HTML:

<img id="myImage" src="someimage.gif"/>
<script type="text/javascript">
    var str = <?php echo json_encode($json); ?>;
    document.getElementById('myImage').addEventListener(
        'click',
        function() {
            foo(str);
        }
    );
</script>

Or something similer...

Answer 4

Only json_encode() is enough to escape the new line

echo "<img src=someimage.gif onclick=\"foo(".json_encode($newData).")\">";