We Keep Coding

Dealing with javascript function which processes strings that include quotes

So, essentially I have a button being created in PHP, which runs a JavaScript function, for example
function CreateText(id, string){
alert(id + '' + string);
}
So the PHPcode looks like this
echo "<img onclick='CreateText(3,\"$userinput\")'>";
Where user input is coming from a text box. But, whenever the user inputs a string which contains quotation marks, it throws an error.
Any idea how to fix this?

You're trying to create a valid Javascript literal inside an HTML attribute. For the Javascript, use json_encode, to make that a valid HTML attribute, use htmlspecialchars:
$onclick = sprintf('CreateText(3, %s)', json_encode($userinput));
printf('<img onclick="%s">', htmlspecialchars($onclick));
See http://php.net/sprintf, http://php.net/printf, http://php.net/json_encode, http://php.net/htmlspecialchars.

Formatting numbers in a td

My code gets some totals that look like this:
var totals = { someInt:5, someFloat:7.555, someNumberIDoNotNeed:7};
I'd like to present a subset of these in a table in a view (via a jade template). My idea was to put the ones I want into an object, then let JSON.stringify do the formatting for me. I wanted one of the values to be rendered boldface:
var needed = {};
needed["The int is"] = parseFloat(totals.someInt);
needed["The float is"] = "<b>" + parseFloat(totals.someFloat).toFixed(2).toString() + "</b>";
// get rid of the curly braces and add a space after the commas
var string = JSON.stringify(needed).replace(/[{}"]/gi, '').replace(/,/gi, ', ');
Then in my jade view:
td= string
Reviewing this in the Chrome inspector, the string seems to be what I hoped for:
<td>
"The int is:5, The float is:<b>7.55</b>"
</td>
But the browser isn't respecting the markup. I just see the braces and b (< b >) in the output. I've tried a few variants in formatting the output, but the basic problem of the marking showing remains the same. Would appreciate any pointers in the right direction.
(I tried to quote the output using SO's > quote formatting, but it actually respects the in my markup, and this question shows up with the bold output just how I want it. Somehow SO gets this right but I cannot!)

I've never heard of Jade before, but I took a quick look at their editable demos and reference and noticed that td= string syntax escapes html entities but td != string does not.
So that seems to be your problem. You want to keep the html intact in this case. So give td != string a try.

Javascript onclick function call issue: won't pass a string

So the basic rundown is that I'm trying to create a rudimentary means of flagging inappropriate content on our web mapping application.
Within a function that dynamically creates content for the sidebar of the webmap when the user clicks on a point I have this piece of code that should generate an image of a flag.
When the user clicks the flag, I want to run the function flagContent which should pass a url string into the function. From within this function I would then be able to
write it to a database later on (though I haven't made it this far yet).
Here are some code snippets I have been working with.:
1.This is where the flag image is generated
content += "<p class='info'><img id='flag' onclick='flagContent(" + attachmentInfo.url + ")
'src='assets/flag.png' style='height:15px'>Flag as inappropriate...</p>";
This is the connected function
function flagContent(imageUrl){ console.log(imageUrl)}
So basically the url is a string and I'd like to be able to manipulate it within the flagContent function. Unfortunately I can't get it to work. When I pass a numerical parameter such as attachmentInfo.objectID I do not run into the same problem.
For what it's worth I also get this error:
Uncaught SyntaxError: Unexpected token :
Any help would be greatly appreciated. Let me know if there is additional information that could help to solve this. Thanks!

I'm assuming that attachmentInfo.url would return a URL, which should be a string and it just needs to be surrounded by quotes. Since you've already used both types of quotes, you will have to escape some quotes.
content += "<p class='info'>";
content += "<img id='flag' onclick=\"flagContent('" + attachmentInfo.url + "')\" src='file.png'/>";
content += "Flag as inappropriate...";
content += "</p>";
Doing this makes the final out put look like this:
<p class='info'>
<img id="flag" onclick="flagContent('http://example.com')" src='file.png'/>
Flag as inappropriate...
</p>
The problem you had was that the URL was not surrounded by quotes, and it saw flagContent(http://example.com) and didn't know what to do with those bare words not in a string.

convert string to json and than read the json value

First of all, I'm fairly new to json, so please forgive me if I've made a terrible mistake. I've got some code that gets a json object from a website using YQL It returns it as a string. So now I want to parse this into a json object and than read it.
This is my code:
$.getJSON("http://query.yahooapis.com/v1/public/yql?q=select%20*%20from%20html%20where%20url=%22http://iphone-api.uitzendinggemist.nl/v1/episodes.json%22%20and%20xpath=%27*%27&format=json", function(data) {
console.log(data);
content = data.query.results.html.body.p;
json = JSON.stringify(eval("(" + content + ")"));
str = json.revoked;
$('#table').append('<li>' + str + '</li>');
});
JS fiddle
I just can't figure out why this gives me undifined, instead of the value it should give.
So now my question was if someone here knows why it isn't working properly.

The json variable is an array, you need to access an index.
string = json[0].revoked;

You have many many many errors in your code. You should try to understand each step that you are doing, it looks like you don't. Here's a fork of your code that does something, I'm not sure what you want it to do. I'll tell you few things you did wrong:
Use var keyword when declaring new variables within functions
Don't parse JSON using eval(), but use some parser. E.g. $.parseJSON(). Using eval() is a security risk, as returned script WILL be executed on client and you should only be interested in getting data.
When constructing HTML, take care to encode text that you want displayed. In your case, don't concatenate strings ('<li>' + str + '</li>'). You can use jQuery ($('<li>').text(str)).
Don't add li elements to a table element. Either add them to ul or ol elements, or in case of tables create rows and cells.
It is completely unclear why you would eval, and them stringify an object. You end up with same exact data.

How to pass a String variable containing value with hyphens as a java script function parameter

Hi I am a newbie to java script. Have issues in passing the string variable whose value contains hyphen as function parameter. Fire bug throws an error saying 'identifier starts immediately after numeric literal'
I am using flexigrid to display data. In each row have placed an image. On click of that image a java script function should be called. Setting up of flexigrid record content is done in java as below,
record.put("view","<img src='images/ic_text_document.png' onclick='view_content("+objid+")'/> ");
Value of the varible objid is something like this c2692d22-a407-4d38-85ee-5c16f25bcce7.
Firebug throws identifier starts immediately after numeric literal' error by pointing at the 14th digit (in the above example at 4).
Tried passing the variable with different combination of quotes as suggested in other posts but dint work. Can somebody help me with this?

You'll need to escape the objid before generating the html, and unescape when using the value in the javascript.
OR do something like this......
record.put("view","<img src='images/ic_text_document.png' onclick='view_content("+ COUNTER + ")'/><div style='display:none' id='objid"+ COUNTER + "'>" + objid + "</div> ");
where counter is just a different number/value for each obj/objid.
and in js:
function view_content(objidcounter){
var real_objid = document.getElementById('objid' + objidcounter).innerText;
...
...
}

You should quote the objid value, like
record.put("view","<img src='images/ic_text_document.png' onclick='view_content(\""+objid+"\")'/> ");

Because when it render it is showing up as
view_content(FOOBARSTRING)
You need quotes in there.
record.put("view","<img src='images/ic_text_document.png' onclick='view_content(\""+objid+"\")'/> ");
Ideally you would not be adding the onclick handlers in the html markup directly.