php - Proper syntax when using a javascript variable in an HTML link -

i trying combine simple html (php) link , include js variable. have syntax incorrect. suggestions?

$.each(playlist, function(index, val) {     playlisthtml += "<form name="form" method="post" action="../_inc/process_track_move.php?track="+val.sources[0].title" }); 

you should not assembling raw html manually in javascript; it's easy wrong. in case, if code worked, vulnerable encoding errors , xss security issues because doesn't encode attribute value.

the safer choice use dom api, framework, or default-safe templating engine create elements need, automatically care care of encoding attribute values.

here's how use dom api instead of raw html case.

var playlist = document.createelement('div');  // or document.queryselector('#playlist')?  $.each(playlist, function(index, val) {     var form = document.createelement('form');     form.setattribute('name', 'form');     form.setattribute('method', 'post');     form.setattribute('action', '../_inc/process_track_move.php?track=' + val.sources[0].title);     playlist.appendchild(form); });  playlisthtml += playlist.innerhtml; 

you can add created elements directly document, or convert them html string using.

if must use raw html concatenation, can't + text string on html, must encode html first avoid security vulnerabilities or errors. @ minimum, means using function this:

function texttohtml(s) {   return s       .replace(/&/g, '&amp;')       .replace(/</g, '&lt;')       .replace(/>/g, '&gt;')       .replace(/"/g, '&quot;')       .replace(/'/g, '&#39;'); }  

you must escape "s inside string \" them parse correctly. gives us:

playlisthtml += "<form name=\"form\" method=\"post\" action=\"../_inc/process_track_move.php?track=" + texttohtml(val.sources[0].title) + "\"></form>";