Issue calling JS function from PHP echo with a specific variable

Question

I have a JS function that will add keys with values to the current URL. There are two almost identical links below, only difference is the variable being passed to the JS function. One link passes $month, the other passes $event_category. For some reason, when passing $event_category, the JS function doesn't even get called. Anyone know what I'm doing wrong?

You'll have to scroll to the right to see where the difference is.

 $month = 1;
 $event_category = (string) ($eventCategories[$k]["event_category"]);
 echo gettype($event_category); // prints "string"
 // doesn't work?
 echo '<div class="month selected"><a href="javascript:void(0);" onclick="javascript:insertParam('. "'event_category'" .', '. $event_category .');" class="button" role="button">
 <image width="100" height="60" src="images/'. $images_list[$eventCategories[$k]["event_category"]].'"></a></div>'; 
 // works
 echo '<div class="month selected"><a href="javascript:void(0);" onclick="javascript:insertParam('. "'event_category'" .', '. $month .');" class="button" role="button">
 <image width="100" height="60" src="images/'. $images_list[$eventCategories[$k]["event_category"]].'"></a></div>'; 

• Fengyang Wang: This is a major XSS risk, and you really shouldn't be doing this. At least sanitize everything first before dumping it into the HTML.
• Mueyiwa Moses Ikomi: I'll say you put the java script function some where on the page with an onload listener and call the function when you php is loaded.
• Badger: I realize that maybe I should be, but I'm not worried about that. I just want to get this working properly
• Badger: @MueyiwaMosesIkomi Thing with this is there are multiple of these buttons being created. Each one with a different value for $event_category that needs to get passed to the JS function.
• Mueyiwa Moses Ikomi: That can be handled, pass the data in the button using the data attribute. Which you can easily pick up on click using java script to do what you want. Also make sure you sanitise the data before sending back to the server for security reasons

Answer 1

You should put quotes around the $event_category, otherwise it will be interpreted by javascript as a variable. So, convert

. $event_category .

to

. '"' . $event_category . '"' .