将变量从php传递给javascript

Question

我想知道为什么变量用户不起作用.

<script type="text/javascript">
     var user = <?php echo $r;?>;
     document.write(user);
</script>

<form method="post" action="<?PHP echo $_SERVER["PHP_SELF"]?>">
     <input type="text" name="username" placeholder="username"><br><br>
     <input type="password" name="pw" placeholder="password"><br>
     <input type="submit" value="UPDATE" ="loadXMLDoc()">
</form>

Answer 1

假设$r是一个字符串,您需要将其包装在引号中:

var user = '<?php echo $r;?>';

没有引号,浏览器会看到:

var user = Sandeep;

更好的是,使用PHP对JSON编码字符串,这将转义任何引号并防止XSS漏洞:

var user = <?php echo json_encode($r);?>;

旁注,回应$_SERVER["PHP_SELF"]HTML是已知的XSS漏洞.你应该运行它htmlspecialchars():

<form method="post" action="<?PHP echo htmlspecialchars($_SERVER["PHP_SELF"])?>">