Concatenate Javascript with PHP

Question

I’m trying to concatenate PHP with Javascript, but I’m not getting it.

<button onclick="gravaDados('/" . <?php echo nomeCliente; ?> . /"')" class="btn-playpause">Play</button>

Thank you

Answer 1

Here we go:

<button onclick="gravaDados('<?= $nomeCliente; ?>')" class="btn-playpause">Play</button>

The tags <?= ?> want to say the same thing <?php echo ...; ?>.

Difference between php <?php tags and <?=

On second thought, you don’t need counterbars. Use only the simple quotes, you will get the result you search.

If your Apache or IIS, CGI, has not enabled the permission or use of short PHP tags, you can use:

<button onclick="gravaDados('<?php echo $nomeCliente; ?>')" class="btn-playpause">Play</button>

Don’t forget to use $ before the variable name to indicate variables in PHP.

Answer 2

Another alternative might be to use printf (or sprintf depending on the case):

printf('<button onclick="gravaDados(\'%s\')" class="btn-playpause">Play</button>', $nomeCliente);

I don’t think it’s the best option, but it’s another option.

---

Depending on the context I believe it is appropriate to encode the HTML of $nomeCliente to mitigate XSS, in this case something like:

printf('<button onclick="gravaDados(\'%s\')" class="btn-playpause">Play</button>',
htmlentities($nomeCliente, ENT_QUOTES | ENT_HTML5, 'UTF-8'));

Without using the htmlentities, the way the other answers did, if the value of the $nomeCliente for );alert('XSS will inject an alert (or any other malicious code the user obviously wants) into the website, see here.

Answer 3

The problem is that you don’t need to escape the quotes even because to space them is with \ and at the same time are concatenating outside the PHP

Enough like this:

<button onclick="return gravaDados('<?php echo $nomeCliente; ?>');" class="btn-playpause">Play</button>