What's the solution for this kind of problem?

Question

<a onclick="run(&#039;Hi, Tim!  I&amp;#039;ve got two&#039;, &#039;">test</a>

The onclick event is not run at all.

The above is generated by something like this:

<a onclick="run(<?php echo htmlentities($str) ?>)">test</a>

How to fix it?

Answer 1

You are outputting the content of a string without quoting it

Put the echo statements in ''

<a onclick="run('<?php echo htmlentities($str) ?>')">test</a> 

By the way, ' = '

Answer 2

$str , before being entity-encoded, is:

'Hi, Tim!  I've got two', '

which is clearly not a valid JavaScript string literal. The apostrophe is HTML-encoded, which it shouldn't be yet, and there's some trailing nonsense.

You should create JavaScript string (and other) literals using the json_encode function. If you have $rawstr as:

Hi, Tim!  I've got two

then json_encode will give you the correct JavaScript string:

'Hi, Tim!  I\'ve got two'

so you can insert it into an HTML event handler attribute:

<a onclick="run(<?php echo htmlspecialchars(json_encode($rawstr)) ?>); return false;">test</a>

Note htmlspecialchars() , which is preferable to htmlentities() , as the latter will usually-needlessly HTML-escape all non-ASCII characters, which will mess them up if you don't specify the correct charset.

From PHP 5.3, you can use the JSON_HEX_ flags to ensure that the HTML-special characters are never in the output from json_encode , which saves you an encoding step:

<a onclick="run(<?php echo json_encode($rawstr, JSON_HEX_TAG|JSON_HEX_AMP|JSON_HEX_QUOT) ?>); return false;">test</a>

To make your life easier, encapsulate these common output-with-escaping methods into more simply-named functions:

function h($s) {
    echo htmlspecialchars($s, ENT_QUOTES);
}
function j($s) {
    echo json_encode($s, JSON_HEX_TAG|JSON_HEX_AMP|JSON_HEX_QUOT|JSON_HEX_APOS);
}
function u($s) {
    echo urlencode($s);
}

<a onclick="run(<?php j($rawstr); ?>); return false;">test</a>

And even better, avoid using inline event handler attributes at all by binding from script:

<a id="test">test</a>
...
<script type="text/javascript">
    document.getElementById('test').onclick= function() {
        run(<?php j($rawstr); ?>);
        return false;
    };
</script>