[fixed] <script> tag screws up [php]

[Raz Meister]

When using the <script> tag in a PHP tag, it isn't parsed correctly:

Source:
--
<script language="JavaScript" type="text/javascript" src="http://whereever"></script>
End of PHP tag, but still parsing.
--
<script language="JavaScript" type="text/javascript" src="http://whereever"></script>
End of PHP tag, but still parsing.

[Raz Meister]

^BUMP^

[tubedogg]

<script>window.location='newlocation'</script>

[Kier]

<script language="jscript">alert('hello');</script>
<script language="jscript">alert('hello');</script>

[Kier]

Hmm... curious

[Raz Meister]

<script language="jscript">alert('hello');</scriptt>
<script language="jscript">alert('hello');</scriptt>Will it parse this?

[Mike Sullivan]

That's why the [ php] tag is only for valid PHP code.

The only way to fix it is to remove the code that invisibly adds in the <?php and ?> so the code is actually syntax highlighted. Removing that fixes this but removes much of the ease of use, so I don't really think it's worth it...

[Chen]

Originally posted by Ed Sullivan
That's why the [ php] tag is only for valid PHP code.
LOL, now that makes sense! :D

[Raz Meister]

Yes, it does make sense. It still doesn't explain though why it screws up the rest of the page, if correct PHP code is not used.

[Mike Sullivan]

Because when you don't use valid PHP code, the <font> tag (I believe that's what highlight_string() uses) isn't closed. Our substr() calls to dynamically add/remove <?php and ?> expect it to be.

This should work correctly because I am manually including the <?php and ?>:

<?php
<script language="jscript">alert('hello');</script>
?>

[Mike Sullivan]

Oops, now I see what you mean. Not sure why the </blockquote> isn't there...

[Raz Meister]

Heres what a little investigation has found:alert</font><font color="#006600">(</font><font color="#CC0000">'hello'</font><font color="#006600">);</font><font color="#0000</font></code>
<hr></pre></blockquote><font face="verdana, arial, helvetica" size="2" ></font></p>
The tag in bold isn't complete for some reason....
Could be bug within the syntax highlighting function within PHP.

[Mike Sullivan]

Hmm... guess I missed the </blockquote>. In which case, this is the issue:

Because when you don't use valid PHP code, the <font> tag (I believe that's what highlight_string() uses) isn't closed.

Therefore our substr() to remove the ?> at the end removes some incorrect stuff (part of the font tag you bolded)...

[John]

Do we have a bug?

I am unsure having read through all that!

John

[Raz Meister]

Yes, I think so, because when passing the following string to highlight_string():<script language="jscript">alert('hello');</script>It returns the following string:<code><font color="#000000">
&lt;script language="jscript"&gt;alert('hello');&lt;/script&gt;</font>
</code>

[Raz Meister]

This is valid PHP code:
<SCRIPT LANGUAGE="php"> echo ("Hello World!"); </SCRIPT>

Valid PHP code implemented thorugh the script tags also doesn't give properly formatted output.

<SCRIPT LANGUAGE="php"> echo ("Hello World!"); </SCRIPT>

Valid PHP code implemented thorugh the script tags also doesn't give properly formatted output.

[Mike Sullivan]

We found a better way of stripping out the tags, so this should now be fixed. :)

[John]

That's better now :)

John

[Raz Meister]

Yes it is :)

So.....are these forums running on v2.2.1?