Home » HTML » HTML_QuickForm » Bug #328

[2003-11-30 11:37 UTC] ignatius dot reilly at free dot fr

Description:
------------
In the JS array created to govern the option list, variable content is not escaped, but should.

Reproduce code:
---------------
htpp://www.auderghem-analytica.com/download/QF_bug_test_case.txt

Expected result:
----------------
var author_1 = new Array();
author_1[0] = new Array('1', 'O\'Reilly');

Actual result:
--------------
var author_1 = new Array();
author_1[0] = new Array('1', 'O'Reilly'); // breaks JS!!

I suggest the following fix:
line 155 of HTML/Quickform/hierselect.php:

replace:
$this->_js .= $varName."[".$i."] = new Array('".$value."', '".$text."');\n";

by:
$this->_js .= $varName."[".$i."] = new Array('".$value."', '".addslashes(
$text )."');\n";

[2003-12-18 14:25 UTC] mansion at php dot net

This bug has been fixed in CVS.

In case this was a documentation problem, the fix will show up at the
end of next Sunday (CET) on pear.php.net.

In case this was a pear.php.net website problem, the change will show
up on the website in short time.

Thank you for the report, and for helping us make PEAR better.

[2005-01-02 19:57 UTC] support at infinity dot com dot ua

I have a similar problem, tested on rev. 1.12 of hierselect.php.
I can't use double quotes (") in options names below the first level deep, because I'm getting javascript error and hierselect fails to work.

Reproduce code:
---------------
require_once 'HTML/QuickForm.php';

$form = new HTML_QuickForm('bugForm');

$select1[0] = 'foo';
$select2[0][0] = '"bar"';

$sel =& $form->addElement('hierselect', 'bug', 'Bug:');
$sel->setOptions(array($select1, $select2));

$form->display();

Expected result:
----------------
hs_bug_0 = {
"0":"\"bar\""
}

Actual result:
--------------
hs_bug_0 = {
"0":""bar""
}

Possible solution:
------------------
On line 336 of file hierselect.php:
$js .= '"'.$optValue.'":"'.$options.'"';
do some "addslashing" of $options:
$js .= '"'.$optValue.'":"'.addslashes($options).'"';