184816 - <a"test"> parsed to a<atest>

Status: RESOLVED DUPLICATE of bug 43267

(Core Graveyard :: View Source, defect)

Description

[Nielsz]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.3a) Gecko/20021207 Phoenix/0.5
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.3a) Gecko/20021207 Phoenix/0.5

When I enter this tag in my html:
<tag"tag">, in the document source, there's <tagtag>.
Now, this is very disturbing when I want to show databaserecords with " in it.

Reproducible: Always

Steps to Reproduce:
My test.php:
$menu.="
        <tr onclick=\"onClick('".$row['id']."', '".$item['id']."',
this,'".addslashes($row['cmspageid'])."','".addslashes($row['pagename'])."') \">
	";

Actual Results:  
First, set $row['pagename'] to "my test "; (no Javascript errors)
Then, set $row['pagename'] to "my \"test "; (a javascript error appears, the
last " is removed! (the " before the '>' )

Expected Results:  
Just like IE, it should not change at all, but remain <a"test">

This happens in 
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.2) Gecko/20021126
Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.3a) Gecko/20021207 Phoenix/0.5

so, Mozilla 1.2 and Phoenix 0.5

Comment 1

[Jo Hermans]

Can you give us a link to a page where this can be seen ? Or post the generated
HTML-code in this bug, so we can verify what's happening.

Comment 2

[Nielsz]

Please check the source of: 

http://www.guts.nl/~niels/

first in Phoenix 0.5 OR mozilla 1.2, then compare it with the IE version.
(the < > stuff is set on purpose there in the comments! )

Comment 3

[Boris Zbarsky [:bzbarsky]]

So this is just a viewsource bug, huh?

Comment 4

[Nielsz]

No!

Because, I also get a Javascript error on the row that has the "!
The output is:

<tr onclick="onClick('1', '', this,'1','New!!! \"') > 
<tr onclick="onClick('2', '', this,'2','swing!') "> 


The error is: 
Error: unterminated string literal
Source Code:
onClick('1', '', this,'1','New!!! \

So, not only in the sourcecode, it really is in the parser!

Comment 5

[Boris Zbarsky [:bzbarsky]]

That error is correct.  You're creating the following markup:

<tr onclick="onClick('1', '', this,'1','New!!! \"')" > 

Which means the value of the "onclick" attribute is "onClick('1', '',
this,'1','New!!! \" because the backslash character is _not_ an escape character
in HTML.  You should be using &quot; instead of \"

Comment 6

[Nielsz]

That is correct. [shame ;) ]

Comment 7

[John Levon]

bug 43267 or one of the others hanging off bug 57724

Comment 8

[Christopher Hoess (gone)]

*** This bug has been marked as a duplicate of 43267 ***