Why aren't <script> tags not working on this PHP page?

Question

When I try to enter

<script type="text/javascript" >
alert("hello");
</script>

in the comment box on my PHP page I do not get an alert box. I see the script in my text file, not on the webpage. For some reason the <script> isn't executing. I have active scripting and javascript enabled on all my browsers.

My PHP code:

<?php //CFPcomments.php

include_once 'CFPheader.php';




if (isset($_POST['content']))
{
    $fp = fopen('comments.txt', 'a');
    fwrite($fp, $_POST['content'] . "<br />");
    fclose($fp);
}

echo nl2br(file_get_contents('comments.txt'));





echo <<<_END
<h3>Post comment</h3>
<form action='CFPcomments.php' method='post'>
<textarea name='content' rows ='3' cols='100'></textarea>
<br/>
<input type='submit' value='Post' />
</form>
_END;
?>

Strange. I got it to work, not sure why.

    <!DOCTYPE html>
<html>
<head>
    <title></title>
    <script type="text/javascript">
        alert("hello");
    </script>
</head>
<body>

</body>
</html>

When I type this in it seems to work

Anyone have any idea why???? Very confused.

$(window).load(function() { alert("window load occurred!"); }); — Amol Navsupe
– Amol Navsupe, Commented Apr 16, 2014 at 4:30
@winner You may want to do some reading on XSS if you haven't already. Allowing comments to contain Javascript makes you immediately vulnerable to that kind of attack. Depending on the use case you may be okay with that. — Paul
– Paul, Commented Apr 16, 2014 at 4:35

Scuzzy · Accepted Answer · 2014-04-16 04:32:28Z

4

your nl2br() is most likely translating

<script type="text/javascript" >
alert("hello");
</script>

to

<script type="text/javascript" ><br/>
alert("hello");<br/>
</script><br/>

and breaking the JavaScript code.

answered Apr 16, 2014 at 4:32

Scuzzy

12.4k2 gold badges50 silver badges48 bronze badges

Sign up to request clarification or add additional context in comments.

7 Comments

Bhojendra Rauniyar Over a year ago

why do you think so, script tag is in nl2br()

ajax333221 Over a year ago

breaking is a harsh word, I would say enhancing it to a point where it no longer serves its original purpose

Scuzzy Over a year ago

@c-link if the intention is to echo the <script> tag unmodified, then nl2br() will be modifying it.

Scuzzy Over a year ago

What does your browsers source indicate?

GlobalJim Over a year ago

Ah yes, it is adding the <br/> tags

|

GlobalJim · Accepted Answer · 2014-04-16 18:39:08Z

0

I assigned a variable to the content, then displayed the variable in the PHP code. Now it works.

<?php //CFPcomments.php

include_once 'CFPheader.php';


setcookie("username", $GLOBALS['user'], time()+3600);
setcookie("password", $GLOBALS['pass'], time()+3600);
if (isset($_POST['content']))
{
    $fp = fopen('comments.txt', 'a');
    fwrite($fp, $_POST['content'] . "<br />");
    fclose($fp);
}

$comment =  file_get_contents('comments.txt');





echo <<<_END
<h3>Post comment</h3>
'$comment'
<form action='CFPcomments.php' method='post'>
<textarea name='content' rows ='3' cols='100'></textarea>
<br/>
<input type='submit' value='Post' />
</form>
_END;
?>

answered Apr 16, 2014 at 18:39

GlobalJim

1,2092 gold badges19 silver badges24 bronze badges

Collectives™ on Stack Overflow

Why aren't <script> tags not working on this PHP page?

2 Answers 2

7 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

7 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related