Member Avatar for Kewne

I have this line of code:

$str = "$str<td><a href=\"javascript:Open($Row->ID , $Row->IDCode)\" title=\"click to open window...\">more...</a></td></tr>";

it works fine when the IDCode at the $Row->IDCode is a numeric but then it doesn't work anymore when the IDCode starts with a character.

At my database the ID is int(11) unsigned and the IDCode is varchar(10)....

the javascript for this is:

function Open(susi,kodigo) {

    if (susi) {
        Win = window.open("View.php?View=" + susi + "|" + kodigo , "winMore", "height=480, width=450, resizable=yes, scrollbars=yes, top=100, left=125");
    }
}

...it's not clear to me why it doesn't work on characters....

please help...thank you in advance...

Edited by Kewne
  • 2 Contributors
  • 2 Replies
  • 185 Views
  • 14 Minutes Discussion Span
  • Latest Post Latest Post by Kewne

Dani AI

Generated

Brief diagnosis and safer fixes. The original anchor generated an unquoted JavaScript argument, so an IDCode that starts with a letter is parsed by the JS engine as an identifier (an undefined variable) while a numeric token parses as a number. As pointed out, quoting fixes that case—but a more robust approach is recommended.

Make the anchor a real link (works without JavaScript) and use an event listener to open the popup. This avoids inline javascript: handlers and all the quoting/escaping pitfalls:

<!-- server-side: produce a working URL (ID cast to int, code URL-encoded) -->
<a class="open-link" href="View.php?View=<?php echo rawurlencode(((int)$Row->ID) . '|' . $Row->IDCode); ?>">
  more...
</a>

<script>
document.addEventListener('click', function (e) {
  var a = e.target.closest('.open-link');
  if (!a) return;
  e.preventDefault();
  window.open(a.href, 'winMore', 'height=480,width=450,resizable=yes,scrollbars=yes,top=100,left=125');
});
</script>

Alternative: export values via data attributes and build the URL in JS (use encodeURIComponent for the client side):

<a href="#" class="open-link" data-id="<?php echo (int)$Row->ID; ?>" data-code="<?php echo htmlspecialchars($Row->IDCode, ENT_QUOTES); ?>">more...</a>

<script>
document.addEventListener('click', function (e) {
  var a = e.target.closest('.open-link');
  if (!a) return;
  e.preventDefault();
  var url = 'View.php?View=' + encodeURIComponent(a.dataset.id + '|' + a.dataset.code);
  window.open(url, 'winMore', 'height=480,width=450,resizable=yes,scrollbars=yes,top=100,left=125');
});
</script>

Notes and cautions: cast numeric IDs to int on the server, escape HTML attributes with htmlspecialchars, and URL-encode query parts (rawurlencode or encodeURIComponent). Embedding JS literals with json_encode() is another option, but be careful with attribute quoting if the JSON string contains quotes. Avoid href="javascript:..." for accessibility and security reasons.

Recommended Answers

All 2 Replies

Member Avatar for pritaeas

If your code starts with a character, it is considered a string and needs single quotes around it.

Member Avatar for Kewne

thank you it worked men!

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.