Member Avatar for Member #908835

How does this work?

<?php
echo '<script type="text/javascript">
var str='.include("engine.php").';
var str_esc=escape(str);
document.write(str_esc)
</script>';
?>

What this script should do in my point of view outcome is to escape the whole page so the source page is not viewing the html and everything, rather then the escaped characters.

this won't work, i don't know why, can anyone help?

Edited by Dani because: Moved to PHP forum
  • 3 Contributors
  • 3 Replies
  • 97 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by almostbob

Dani AI

Generated

Quick diagnosis: using include() directly inside the string you echo sends the included file's output straight into the response and does not produce a safely quoted JavaScript string. If the included file has no return it yields the boolean true (prints as 1 when concatenated), and any unescaped quotes or </script> sequence in that output will break the surrounding script — exactly what warned about. was right to ask for the included file: the exact content matters.

Two practical fixes (capture and then escape):

// capture executed output and render it as visible source
ob_start();
include __DIR__ . '/engine.php';    // executes the file
$content = ob_get_clean();

echo '<pre>' . htmlspecialchars($content, ENT_QUOTES, 'UTF-8') . '</pre>';
// capture executed output and embed safely into JS
ob_start();
include __DIR__ . '/engine.php';
$content = ob_get_clean();

echo '<script>var str = ' . json_encode($content, JSON_HEX_TAG|JSON_HEX_AMP|JSON_HEX_APOS|JSON_HEX_QUOT) . ';
console.log(str);</script>';

Notes and troubleshooting:

  • If you want the source file without executing PHP, use file_get_contents() instead of include(). See the PHP docs for include, ob_start, file_get_contents, json_encode, and htmlspecialchars for details.
  • Use htmlspecialchars() to show HTML as escaped entities in the page (so users see < as &lt;).
  • Use json_encode() with the JSONHEX* flags to produce a JS-safe literal and to avoid the </script> problem that can close the script block prematurely.
  • If you still see a stray 1 in output, that is likely the return value of include() being concatenated; capturing with output buffering avoids that.
  • Always validate/sanitize whatever you display to prevent XSS when including third-party or dynamic content.

References: PHP manual pages for include (https://www.php.net/manual/en/function.include.php), ob_start (https://www.php.net/manual/en/function.ob-start.php), json_encode (https://www.php.net/manual/en/function.json-encode.php), and htmlspecialchars (https://www.php.net/manual/en/function.htmlspecialchars.php).

Recommended Answers

All 3 Replies

Member Avatar for pritaeas

Perhaps if you explain what you are trying to achieve... Or show what's inside engine.php

Member Avatar for almostbob

<?php echo '<script type="text/javascript">var str="';
include("engine.php");
echo '"; var str_esc=escape(str);document.write(str_esc);
</script>'; ?>

Member Avatar for almostbob

OOPS::
ensure that the output of engine.php does not output any unescaped dquotes, which would terminate the variable str and cause errors

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.