Since you are using a double quoted string literal in php, you can't use unescaped double quotes inside the string. Then again, because your html output is using single quoted attribute values, you can't use unescaped single quotes within the attribute values.
Using escaped double quotes around the attribute values and using single quotes inside them
echo "<a onclick=\"window.open('stuff')\">click me</a>";
Using single quotes around the attribute values and escaped single quotes inside them. Do note that quotes are escaped differently in html than in php.
echo "<a onclick='window.open(&# 39;test& #39;)'>click me</a>";
IMPORTANT: in the above there should be no spaces in [noparse]'[/noparse]. Unfortunately, on this board, I can only display that sequence of characters within noparse tags, and noparse tags do not work inside html tags. Moreover, inside the html tags [noparse]'[/noparse] is resolved into ' while &#39; is NOT resolved intp [noparse]'[/noparse].
If you want to inspect what the "insides" of the a element looks like, you can either right click your browser and "show source" (or similar) because the source is before character entity replacement. You could also run the above through htmlentities which replaces all characters by their corresponding entities (if they have one).
echo htmlentities("<a onclick='window.open('test')'>click me</a>", ENT_QUOTES, 'utf-8');
Using sprintf
printf('<a onclick="%s">Click me</a>',
sprintf("window.open('%s');",
"stuff"
)
);
You still need to either escape or alternate quote types inside the attribute values. But this way you only have 2 sets of quotes to work with in each step.
