We Keep Coding

How do I use PHP to encode a string containing quotes to make it safe for inline 'onclick'?

I have a variable in a database that could potentially contain single or double quotes. When I retrieve the variable from the database, it is written with PHP into an inline "onclick" hander:
echo '<li><a onClick="a4e.duplicate_assignment('.$this_assignment['id'].',\''.htmlspecialchars($this_assignment['title'],ENT_QUOTES).'\',\'/assignments/'.$type.'/\');" href="javascript:void(0);">';echo '<i class="fa fa-copy"></i> Duplicate assignment</a></li>';
This produces HTML that looks like this in the page source:
<li><a onClick="a4e.duplicate_assignment(92,'ELLLO - 'If I had a million dollars'','/assignments/cloze/');" href="javascript:void(0);"><i class="fa fa-copy"></i> Duplicate assignment</a></li>
However, clicking the link produces the following error in the console:
Uncaught SyntaxError: missing ) after argument list
I thought using the PHP function "htmlspecialchars" would mitigate this issue, but it doesn't seem to work.
Any help greatly appreciated.
P.S. It is not possible in this case to use a Javascript "onclick" handler - it has to be inline HTML. Also, it is not possible to ban the use of quotation marks in the variable value.

Try using the function:
addslashes()
EDIT: This method will take care of the quotes in the string itself, but may not be suitable if you need to retain quotes for HTML insertion. Read the docs carefully.
http://php.net/manual/en/function.addslashes.php

its because your Unicode (') is also being treated as '
use this
<li><a onClick="a4e.duplicate_assignment(92,'ELLLO - \'If I had a million dollars\'','/assignments/cloze');" href="javascript:void(0);"><i class="fa fa-copy"></i> Duplicate assignment</a></li>

Use json_encode to convert a value to a JavaScript literal (with all necessary escaping).
Use htmlspecialchars to convert a value (such as a JavaScript program) to something safe to place in an HTML attribute value.
$id = $this_assignment['id'];
$title = $this_assignment['title'];
$url = "/assignments/$type/";
$js_id = json_encode($id);
$js_title = json_encode($title);
$js_url = json_encode($url);
$js = "a4e.duplicate_assignment($js_id, $js_title, $js_url);
$html_js = htmlspecialchars($js, ENT_QUOTES);
?>
<li>
<a href="javascript:void(0);" onclick="<?php echo $html_js; ?>">
<i class="fa fa-copy"></i>
Duplicate assignment
</a>
<li>
A better approach would be to use progressive enhancement and non-inline JS. You've ruled that out, but you should try to remove that restriction.
$id = $this_assignment['id'];
$title = $this_assignment['title'];
$url = "/assignments/$type/";
$html_id = htmlspecialchars($id, ENT_QUOTES);
$html_title = htmlspecialchars($title, ENT_QUOTES);
$html_url = htmlspecialchars($url, ENT_QUOTES);
?>
<li>
<a href="<?php echo $html_url; ?>" data-title="<?php echo $html_title; ?>" data-id="<?php echo $html_id; ?>">
<i class="fa fa-copy"></i>
Duplicate assignment
</a>
<li>
<!-- and later -->
<script>
document.querySelector("a").addEventListener("click", duplicate_assignment_handler);
function duplicate_assignment_handler(e) {
e.preventDefault();
a4e.duplicate_assignment(this.dataset.id, this.dataset.title, this.href);
}
</script>
</script>

JavaScript function call in href attribute

I am attempting to call a basic javascript function through the href attribute in an <a> tag. I have done this countless times before, but now every browser is throwing exceptions in jQuery on the href javascript call and and some browsers elect not to run it but rather open a blank new window. I am just purplexed at this point. Any ideas?
HTML:
<td>
<a href="javascript:showQuote(12);" data-toggle='modal' target='#quoteBox'>
View Quote
</a>
</td>
JavaScript/jQuery:
function showQuote(id){
$("#spot").load("viewQuote.php?id=" + id);
$('#modal').modal('show');
}
Chrome is the only browser in which this works (it still throws an error). I have run this through some online validators and they turned up clean.
Also, I am using jQuery version 1.11.3.

It's better to write this in "jquery" style.
Updated answer - using current controls id
<td>
<a href="" data-toggle='modal' id="12" class="mylink" target='#quoteBox'>
View Quote
</a>
</td>
In Document.Ready..
$('.mylink').on('click',function(event){
event.preventDefault();
var id = $(this).attr('id');
$("#spot").load("viewQuote.php?id=" + id);
$('#modal').modal('show');
})

HTML
<td><a href="javascript:showQuote(12,event);" data-toggle='modal' target='#quoteBox'>View Quote</a></td>
Javascript
function showQuote(id,event){
$("#spot").load("viewQuote.php?id=" + id);
$('#modal').modal('show');
event.preventDefault();
return false;
}

Including php script inside javascript confirm box

i have included a confirm box in my PHP page which works fine the following is the code
<a href="" onclick="return confirm('Acc No : \nCANDIDATE NAME : \n\nPLEASE CONFIRM ')" >hi</a>
now i want to display value returned by PHP after Acc NO and CANDIDATE NAME i have written a code which is not working the code is below
<a href="" onclick="return confirm('AIN NO :<?=fetchresullt['acc_no']; ?> \nCANDIDATE NAME : <?=fetchresullt['acc_candidatename']; ?> \n\nPLEASE CONFIRM ')" >hi</a>
please help me out

Try with this
<a href="" onclick="return confirm('AIN NO : "<?php echo fetchresullt['acc_no']; ?>" \nCANDIDATE NAME : "<?php echo fetchresullt['acc_candidatename']; ?>" \n\nPLEASE CONFIRM ')" >hi</a>

Are you sure fetchresullt['acc_no'] is spelt correctly? Doesn't it need to be a variable? ie:
<?=$fetchresult['acc_no']?>
Also make sure you are not including it in a .js file, but make it inline JS code in a .php file.

javascript onClick is not not working in php

I am echoing a html form with php which has the following lines:
<a class='btn btn-sm btn-danger pull-right' onClick=return confirm('Delete This account?'); href='".url('deleteuser/'.$order->id)."' >Delete</a>
This correctly goes to the url specified. However, the onClick method is never triggered. Any help is much appreciated.

EDIT: Clarified pure HTML versus echo string.
Put quotes around the onclick attribute value.
i.e. in pure HTML:
onClick="return confirm('Delete This account?');"
So if you are outputting this via echo, you need to escape the respective type of quote characters with a backslash.
echo 'onClick="return confirm(\'Delete This account?\');"';
or
echo "onClick=\"return confirm('Delete This account?');\"";

Upvoted #faintsignal answer because it is correct, your confusion of single quotes is causing, however a much better way to do this is separate the PHP from the HTML:
<?php
foreach($someItem as $someKey => $order){
?>
<a class="btn btn-sm btn-danger pull-right" onClick="return confirm('Delete This account?');" href="<?php echo url('deleteuser/'.$order->id); ?>">Delete</a>
<?php
}
?>
Just providing an alternative, and it's generally considered good practice because you have clear separation of duties and its easier to maintain.
EDIT: provided a super generic example of using foreach, obviously you can mod for your setup but it shows you can separate the function and it will run just fine.

Html with javascript in php seems to be conflicting

The code i want to get into a php statement is
<a href="javascript:void();"
onclick="document.loginfrm.user.value="username";
document.loginfrm.pass.value="password";
document.loginfrm.submit();">login
</a>
So what i would normally do is just surround it with an echo and quotation marks: an then replace any quotation marks in the statement with these --> ('), so that's what i did... and for some reason it seems to misinterpret the sentence severely. Here is the code i enter in php.
echo "<a href='javascript:void();'
onclick='document.loginfrm.user.value='username';
document.loginfrm.pass.value='password';
document.loginfrm.submit();'>". login ."</a>";
And this is how the browser interprets it:
<a href="javascript:void();
" onclick="document.loginfrm.user.value=" username';=""
document.loginfrm.pass.value="password" ;="" document.loginfrm.submit();'="">
login</a>
So yes is there any way around displaying html within php that could get around this problem

Can you try this, added \
echo "<a href=\"javascript:void();\"
onclick=\"document.loginfrm.user.value='username';
document.loginfrm.pass.value=password';
document.loginfrm.submit();\">login </a>";

You need to escape it properly. Try
echo "<a href=\"javascript:void();\"
onclick=\"document.loginfrm.user.value='username';
document.loginfrm.pass.value='password';
document.loginfrm.submit();\">". $login ."</a>";

You're not escaping your quotes. Try:
echo "<a href=\"javascript:void();\"
onclick=\"document.loginfrm.user.value='username';
document.loginfrm.pass.value='password';
document.loginfrm.submit();\">". login ."</a>";
which should produce:
<a href="javascript:void();"
onclick="document.loginfrm.user.value='username';
document.loginfrm.pass.value='password';
document.loginfrm.submit();">login
</a>
As you have it now, you're closing the onclick attribute when you hit the quote at the start of the "username" value, which means the browser is interpreting username as another attribute and it just gets more confused from there...
Edit: sorry, fixed the html, rather than the php code...

You should do something like this..
<a href="javascript:void();"
onclick="document.loginfrm.user.value='username';
document.loginfrm.pass.value='password';
document.loginfrm.submit();">login
</a>
and with php it should be
echo '<a href="javascript:void();"
onclick="document.loginfrm.user.value=\"username\";
document.loginfrm.pass.value=\"password\";
document.loginfrm.submit();">
login
</a>';