title: php & javascript alert that contains a string with double quote
body: <p>This is an example of string that should I output in a javascript alert();</p>
  
  <p><code>string with "double quote" in it</code></p>
  
  <p>Because this string can be edited via PHP by my users it's better to prevent XSS attacks. To do so in the HTML of my document I usually do: </p>
  
  <pre><code>&lt;?php echo( htmlspecialchars( $MY_STRING, ENT_QUOTES, 'UTF-8' ) ); ?&gt;
  </code></pre>
  
  <p>That works great.</p>
  
  <p>But now I just noticed that if I output the same string in a javascript alert:</p>
  
  <pre><code>&lt;script&gt;
  alert( "&lt;?php echo( htmlspecialchars( $MY_STRING, ENT_QUOTES, 'UTF-8' ) ); ?&gt;" );
  &lt;/script&gt;
  </code></pre>
  
  <p>The output of the alert in this case is:</p>
  
  <p><code>string with &amp;quot;double quote&amp;quot; in it</code></p>
  
  <p>What is the best way to output the double quotes in a alert, but also preventig XSS injection?</p>