Because of Content-Security-Policy (CSP) my inline <script> tags will be blocked if they don't contain a nonce=" ... " variable. I create the $nonce variable in PHP with the built in Wordpress method at the top of my template:
<?php $nonce = wp_create_nonce( 'secret-for-inline-js' ); ?>
Then I evaluate the script tags' nonce value in my html to allow it to be echoed into the output by php. This works for all but two scripts that are located in two wp-blocks of the Plain HTML type in the page editor.
<?php
if ( ! wp_verify_nonce( $nonce, 'secret-for-inline-js' ) ) {
die( __( 'You cannot do that', 'textdomain' ) );
} else { ?>
<script nonce="<?php echo $nonce ?>"> // JS goes here
</script>
<?php } ?>
The codeblocks in the editor load JS scripts with config for Chart.js (the chart library loads correctly from an external source I explicit authorize in the CSP). The client wants to edit the charts, so it has to be like this. I need to add the nonce variable to the script tags here, too because I cannot use the 'unsafe-inline' value for script-src in the CSP (because it contradicts the whole point of using CSP).
I'm aware of different methods to read the PHP variable in html or javascript and methods to pass it into the script tags, like these:
Adding nonce to <script> tag
How do I pass variables and data from PHP to JavaScript?
However, I cannot do this because the script tag isn't a typical external javascript loaded via the Wordpress functions.php setup. I cannot use PHP because it's not supported by the editor (and I cannot use a PHP plugin to allow editor php because of safety measures).
So I wonder if there's a workaraound to get a variable into <script nonce="variable_here"> while read from the WP editor.
My only idea so far is to add a class/id to these two script tags and target them with JS after they have been read by html, and then change the content of the script tag (but I'm not sure if this would actually make it run and load chart.js). I don't see a way to wrap everything in a JS function that forces execution of what's inside, because this script would also need the nonce parameter to run...!
Thanks for your suggestions.
Is there a PHP require_once or include_once for <script>? I know <script> is pure HTML, but does PHP or HTML have such a thing?
I would like to prevent javascript from loading twice in the same page.
Example:
<script type="text/javascript" src="js/jquery-0.4.ajaxify.min.js"></script>
Seems like you are looking for this:
http://wonko.com/post/painless_javascript_lazy_loading_with_lazyload
One of the way you can run script tags in php would be
<?php
....Here is php code
?>
... add the script here(<script>....</script>
<?php
?>
Another probable way is :
Using php inside the script tags for example:
<script type="text/javascript">
var alertMsg = '<?php echo $custom_message; ?>';
alert(alertMsg);
</script>
If you are using buttons
echo('<button type="button" onclick="customfunction();">My Button</button>');
<script>
//call your customfunction here
</script>
AN UPDATE TO SOLVE LOADING SCRIPT CONTENTS TWICE
I would suggest use of javascript function which are called to the specific page as they are needed an example would be
Create a file with a .js eg
example.js
here declare your functions you would put in the script tags of a html page
In the page you want to use the <script>
Include the example.js file and you can call the custom functions from there use the obect orientend approach
Check This resource for more info about obect orientend javascrip
I would like to load the following page inside another page after the main page has loaded. I have the following code:
<script language="javascript">
$(document).ready(function(){
$.get('http://$_SERVER[SERVER_NAME]/X.php?logon=Y&vendorref="<?php .$row_RS_Product['id'].?>"&mode=product', function(data) {
$('#tabs-6').html(data);
});
});
</script>
I am not very familiar with this code so please excuse me if I made the obvious mistake
Could anybody help please as it does work when using file_get_contents in php, but this is slowing the page load down tremendous.
Any help welcome
I think you want to get $_SERVER[SERVER_NAME] from PHP so you need to add <?php echo when creating the url to get from. Also you need to have echo when opening the php tag to echo, not . .
Dot is used to concat string in php like this "aaa" . "bbb" (without opening the php tag)
So you need something like this:
$.get('http://<?php echo $_SERVER[SERVER_NAME]; ?>/X.php?logon=Y&vendorref="<?php echo $row_RS_Product['id']; ?>"&mode=product', function(data) {
$('#tabs-6').html(data);
});
I have an audioplayer running on my website.
Currently there's no problem with the player although I wish to obfuscate my javascript code.
The problem is that the javascript is called on a page which includes a php file.
the player.php contains:
<script type="text/javascript">
$(function(){
$('.player').plate({
playlist: [
<?php
include ('inc/trackimport.inc.php');
?>
]
});
});
</script>
And trackimport generates (in a foreach for each $dj found in the database):
echo '{"title":"'.$dj.'", "artist":"'.$set.'", "cover":"http://domain.com/'.$imglink.'", "file":"http://domain.com/'.$djurl.'/Archive/'.$url.'"},';
Is there away to make this full code obfuscated?
Your best bet would be to use one of these PHP-based JavaScript minifiers. It's basically the same effect, but you can probably put in a configuration flag to make one of them run only when you want it.
On my site I have one global Javascript file which includes jQuery and code for the drop down menu among other things. Many pages also have custom Javascript for minor page-specific interactions, tables etc.
My current set up on each view is a header.php file, basically covering everything from the doctype through to start of the content, the view file for the specific page, and a footer.php closing out the page.
Currently global.js is linked from the <head>. For performance we should put JS at the very bottom of the page, but I can't figure out a good way to do this. I could add the full script line for global.js with the custom script block, but that means I must add it on every page, even when there is no other Javascript. Any better way to move the JS right to the bottom?
You could put the custom JS in a regular variable or nowdoc (php 5.3.0+), and then echo the variable along with script tags in the footer if it exists. Nowdoc might be preferable because you can use both double quotes and single quotes in your JS and PHP won't parse/escape the text.
someview.php:
<?php
$custom_js = "
alert('custom js ran');
";
?>
<?php
$custom_js = <<<'CUSTOM_JS'
alert("custom js ran (i'm in a nowdoc!)");
CUSTOM_JS;
?>
footer.php:
<?php if(isset($custom_js)) { ?>
<script><?php echo $custom_js; ?></script>
<?php } ?>
Edit 2:
If you don't want to have the javascript in a string, you could have the javascript in a seperate file and then use PHP's file_get_contents() to load it into the $custom_js variable as a string.
Edit:
This is just an aside, but you might look into using the Carabiner library for loading JS and CSS. It's an excellent library. It might not necessarily help with your current problem, but if your global.js is quite large, you could split it up and use Carabiner to compress/concatenate on load. I currently use it to select which JS and CSS gets loaded for logged in and logged out users on my current CI project.
Carabiner on Github
Carabiner on Sparks
Carabiner documentation
Perhaps I missed something - but why cant you just load another view, which only contains the js code?
Your template:
$this->load->view("header.php");
$this->load->view("content.php", $data);
$this->load->view("footer.php", $load_js);
Then inside footer.php:
// start of footer stuff here
$this->load->view($load_js);
</body>
</html>
Then inside page1.php:
<script>
// Your scripts here
</script>
OR:
Your template:
$this->load->view("header.php");
$this->load->view("content.php", $data);
Then inside each "content.php" file:
// Content goes here
$data['load_js'] = "page1.php";
$this->load->view("footer.php", $data);
Then inside single "footer.php" file:
// start of footer stuff here
$this->load->view($load_js);
</body>
</html>
Then inside page1.php:
<script>
// Your scripts here
</script>
The second method is probably more what you want. It does mean you need to call the footer in each content file - but it is literally one line - so your not really repeating yourself - but it gives you complete control inside the content file to specifically any js files to load.
You can expand this an make the $load_js variable an array of js files to load.
I use a set of layouts, which are views that provide the basic structure of the site. Every controller calls a layout and passes into it the content specific for that controller method.
For example, say you have a single layout:
<html>
<head>
<title><?php echo $page->title ?></title>
<?php if (count($page->css)): ?>
<?php for ($i=0; $i < count($page->css); $i++): ?>
<link rel="stylesheet" href="<?php echo $page->css[$i] ?>"/>
<?php endfor; ?>
<?php endif; ?>
</head>
<body>
<?php $this->load->view('header.php'); ?>
<?php $this->load->view($content); ?>
<?php $this->load->view('footer.php'); ?>
<?php if (count($page->js)): ?>
<?php for ($i=0; $i < count($page->js); $i++): ?>
<script src="<?php echo $page->js[$i] ?>"></script>
<?php endfor; ?>
<?php endif; ?>
</body>
</html>
Each page passes in a $page object that contains an array of css and js files. For files that are global, like global.js, you can just hardcode that in at the bottom (same with global CSS at the top). Or, you can set a parent controller that all controllers inherit from. This way you can set up the $page object with default settings (including adding global.js). Then, each controller/method can remove global.js if it's not needed.
Each page also passes in a $content variable with the location of the main view for the page.
You can extend this even further by having multiple layouts and moving some of the HTML into the layout (e.g. 1 column, 2 column, 3 column layouts). In those cases, you may pass in multiple view locations for each column, etc. It's really up to you.
Of course, to keep all JS at the bottom you'd need to move all your page-specific custom JS into JS files. That's actually the best way to go, considering external JS can be cached.
Make a helper function; and load a view where you include that global.js script. Anytime you need global.js to be located at the bottom of the page, just call that helper function.
Another option is to use a template library.
I use this one by Williams Concepts.
It allows you to add JS (and CSS for that matter) for individual class/method calls.
For example:
class foo exends Controller {
public function bar() {
$this->template->add_js('js/jquery.js');
$this->template->add_js('alert("Hello!");', 'embed');
$data = $this->some_model->get_data();
$this->template->write_view('content', 'user/profile', $data;
$this->template->render();
}
}
Using this you can either add the JS as and when required, or add it into the template for the site.
In your case, I would either add the global.js in the footer of the template or define a region in the footer of the template when you can add any JS required.
Controller / add function
public function add()
{
$data['page_title'] = 'Test | Add Details';
$data['js'] = array('details','details2');
$this->load->view('template/header',$data);
$this->load->view('details/add');
$this->load->view('template/footer',$data);
}
in your footer template load all the common scripts that are needed, like jquery.min.js, bootstrap.min.js and so on. later add the below code
footer
<!-- Jquery Core Js -->
<script src="<?= base_url() ?>assets/plugins/jquery/jquery.min.js"></script>
<!-- Bootstrap Core Js -->
<script src="<?= base_url() ?>assets/plugins/bootstrap/js/bootstrap.js"></script>
<?php
if(isset($js) && count($js) > 0)
{
for($i=0;$i<count($js);$i++)
{
?>
<script src="<?= base_url() ?>assets/js/custom/<?= $js[$i] ?>.js"></script>
<?php
}
}
?>
</body>
</html>
pass all the js files to be loaded in the array.
If you have a footer.php file that's included on everypage, why can't you just put your js code in that file?