将参数从服务器端PHP传递到客户端JavaScript的最安全的方式是什么?

This question already has an answer here:

这个问题已经有了答案:

How to pass variables and data from PHP to JavaScript? 15 answers
如何将变量和数据从PHP传递到JavaScript?15个答案

In my application I rely heavily on JavaScript to enhance the user interface, but all of the data comes from a database and is processed by PHP. By default I use 'echo' statements to substitute the required values "just in time" like so:

在我的应用程序中，我非常依赖JavaScript来增强用户界面，但是所有的数据都来自数据库，并由PHP处理。默认情况下，我使用‘echo’语句来替换所需的值“及时”，如下所示:

var myVariable = <?php echo $myVariableInPHP ?>

This, however, does not strike me as very elegant and I am concerned about stability and maintainability of such code.

然而，这并没有给我留下非常优雅的印象，我担心这类代码的稳定性和可维护性。

Do I have any alternatives here?

我还有别的选择吗?

For server-side, I am using the Symfony 1.4 PHP framework.

对于服务器端，我使用Symfony 1.4 PHP框架。

Thanks,

谢谢,

5 个解决方案

#1

My favorite way is :

我最喜欢的方法是:

<?php

$var = array(
  'prop1' => 'value1',
  'prop2' => 'value2',
  // ...
);

?>
<script type="text/javascript">
   var varNameSpace = <?php echo json_encode($var); ?>;

   alert( varNameSpace.prop1 ); // -> 'value1'
</script>

Using json_encode() ensures that the values passed to Javascript are escaped and well formatted. Using a common variable container also prevents from over using the global space (window).

使用json_encode()确保传递给Javascript的值被转义并进行了良好的格式化。使用公共变量容器还可以防止过度使用全局空间(窗口)。

#2

You might want to use JSON for this, it's really simple to use in both PHP (check json_encode()) and JavaScript.

您可能需要为此使用JSON，它在PHP(检查json_encode())和JavaScript中都非常简单。

It's safe to use within <script>-Tags and browsers which understand JavaScript. Note that the PHP function doesn't encode < and >.

在

Some example PHP:

一些PHP示例:

$user = (object) array("name"=>"Joseph", "age"=>29, "email"=>"asdf@example.net");
echo '<script type="text/javascript"> var user = '.json_encode($user).'; </script>';

#3

I'd try to use JSON. Here is a link for you to php.net explaining how to do this.

我尝试使用JSON。这里有一个php。net的链接，解释如何做到这一点。

http://php.net/manual/en/book.json.php

#4

First of your solution does work, but It is not a good practice to mix client-side code with server-side code. It is a best practice to put javascript in seperate .js files(no PHP in it)

首先，您的解决方案是有效的，但是将客户端代码与服务器端代码混合使用并不是一个好的实践。将javascript放到分离的.js文件中(不包含PHP)是一种最佳实践

I would first create an API(write documentation) like for example

我首先会创建一个API(写文档)。

GET
http://localhost/getProfile?username=$username

POST
http://localhost/getProfile/$username

It will return JSON-object using json_encode. You could use json-p for cross domain communication. Then from for example Jquery you can easily get the data.

它将使用json_encode返回json对象。您可以使用json-p进行跨域通信。例如，Jquery可以很容易地获取数据。

This way your javascript would stay clean.

这样你的javascript就会保持干净。

#5

I prefer use_dynamic_javascript() helper. "Bad" thing about it is you have to think a bit more on splitting rendering template itself and config for it into separate requests.

我更喜欢use_dynamic_javascript()辅助。“坏”的事情是，您必须考虑在将呈现模板本身和配置文件分割为单独的请求时再多考虑一些。

#1