Php & javascript warning containing double quote string

Question

This is an example of a line that I should output in javascript alert ();

string with "double quote" in it

Since this line can be edited through PHP by my users, it is better to prevent XSS attacks. To do this in the HTML document of my document, I usually do:

<?php echo( htmlspecialchars( $MY_STRING, ENT_QUOTES, 'UTF-8' ) ); ?>

This works great.

But now I just noticed that if I output the same line in a javascript warning:

<script>
alert( "<?php echo( htmlspecialchars( $MY_STRING, ENT_QUOTES, 'UTF-8' ) ); ?>" );
</script>

Alert output in this case:

string with "double quote" in it

What is the best way to output double quotes as a warning, but also an XSS injection prefix?

Answer 1

ENT_NOQUOTES , "" , addslashes js alert.

$string = 'string<< with "double quote" in it';
echo htmlentities(addslashes($string), ENT_NOQUOTES);

:

string<< with \"double quote\" in it

html

Answer 2

alert( "<?php echo( addslashes( $MY_STRING ) ); ?>" );

addslashes() rahter, htmlspecialchars(), . , .

addslashes() http://php.net/manual/en/function.addslashes.php

Answer 3

, XSS, , singlelestring, "

htmlspecialchars, :

<script>
    alert( "<?php echo addslashes($MY_STRING);  ?>" );
 </script>