| Re: resolved?? Re: How to transfer value to iframe? [message #183152 is a reply to message #183150] |
Thu, 10 October 2013 23:37   |
Thomas 'PointedEars'
Messages: 701
Registered: October 2010
Karma:
|
Senior Member |
|
|
Norman Peelman wrote:
> On 10/10/2013 01:01 PM, richard wrote:
>> On Wed, 9 Oct 2013 22:32:22 -0400, richard wrote:
>>> http://mroldies.net/200/audiox.php
>>>
>>> First, the sound will work only in firefox.
>>> So don't go bashing me for that.
>>
>>
>> <?php
>> $number=$numbers[0];
>> echo '<iframe id="x1" src="audiox1.php?asong='.$number.'"
>> name="alpha"></iframe>';
>> ?>
>>
>> At least the first number is now displayed.
>
> echo "<iframe id=x1
> src='audiox1.php?asong=$number&name=$alpha'></iframe>";
The safe syntax is
echo "<iframe id=x1
src='audiox1.php?asong={$number}&name={$alpha}'></iframe>";
> No need to quote the *values*, they are sent as text.
Utter nonsense. Depending on the version of HTML and the attribute value,
attribute values MUST be quoted. The safe approach is to *always* quote
attribute values, it certainly is when attribute values or parts of those
are generated like here. Since double-quoting is more common than single-
quoting, double-quoting as it was done by the OP actually is the safe
approach.
You might have misread the original code, which is actually equivalent to
echo '<iframe id="x1" src="audiox1.php?asong='
. $number
. '" name="alpha"></iframe>';
if we assume that the line-break after “$number.'"” was accidental
originally or was inserted when you quoted the original code.
In particular, in your code the value of $alpha must be *URI-encoded* or the
URI-reference that is the attribute value is invalid or the entire HTML
fragment could become invalid (or code-injected) if $alpha contains space or
special characters. Other generated attribute values, unless it is certain
that code injection is impossible (for example with int values), SHOULD be
htmlspecialchars()'d.
> Not sure what you're doing with -alpha-, I assume it is a variable as
> well...
Does it look like one? RTFM.
PointedEars
--
> If you get a bunch of authors […] that state the same "best practices"
> in any programming language, then you can bet who is wrong or right...
Not with javascript. Nonsense propagates like wildfire in this field.
-- Richard Cornford, comp.lang.javascript, 2011-11-14
|
|
|
|
Calendar
Search
Help
Members
Register
Login
Home
]