<script>
.....
success: function(result) {
var x = `<?php decrypt_url('\\`+ result+`\\') ?>`;
console.log(x)
}
</script>
When PHP returns this page it will execute the decrypt_url function on the string '\\``+ result+``\\' since you can not pass a parameter from JavaScript to PHP like that. Therefore your x will become either nothing (i.e. null) or something random (depending on the decrypt_url function). Use AJAX to pass parameters from JavaScript to PHP.
A simple test case to show what happens:
test.php:
<html>
<head></head>
<body>
<script>
function(result)
{
var x = '<?php echo decrypt_url('+result+',true) ?>';
console.log(x)
}
</script>
</body>
</html>
That will be rendered by the browser as:
<html>
<head></head>
<body>
<script>
function(result)
{
var x = '
As you can see the output starting from the <?php tag is broken.
Some of you might wonder why, so I thought I should extend my answer a bit. First of all this is a logical mistake because the OP makes the assumption that PHP could be controlled from the client-side. I can see that because the piece of code quoted is HTML with embedded PHP where a PHP block itself sits in a piece of JavaScript. Now let's have a look at what happens during execution with a simplified version of the OP's code:
<html>
<head>
<title>Test</title>
</head>
<body>
<script>
function test(result)
{
var x = `<?php strtoupper('\\`+ result+`\\') ?>`;
console.log(x)
}
</script>
</body>
</html>
Let's save that code as test.php and have a look at what PHP makes of it when the file is executed: first of all it basically transform everything to a single PHP script (this is a simplification of the actual process to show the basic principle). After this step your code will look like this:
echo "<html>\n<head>\n<title>Test</title>\n</head>\n<body>\n<script>\nfunction test(result)\n{\nvar x = `";
strtoupper('\\`+ result+`\\')
echo "`;\nconsole.log(x)\n}\n</script>\n</body>\n</html>";
Those who looked closely will probably have spotted the first issue: there is no semicolon after the strtolower(...) call. So let's assume it's there and look at what the line will return when interpreted by PHP:
'\\`+ result+`\\'
I'm pretty sure that is not the input the decrypt_url function of the OP needs. But let's see how the code looks now (with the missing semicolon added):
echo "<html>\n<head>\n<title>Test</title>\n</head>\n<body>\n<script>\nfunction test(result)\n{\nvar x = `";
'\\`+ result+`\\';
echo "`;\nconsole.log(x)\n}\n</script>\n</body>\n</html>";
Now we are missing another echo, without one the second line will cause an error. So let's fix that:
echo "<html>\n<head>\n<title>Test</title>\n</head>\n<body>\n<script>\nfunction test(result)\n{\nvar x = `";
echo '\\`+ result+`\\';
echo "`;\nconsole.log(x)\n}\n</script>\n</body>\n</html>";
So, after fixing the missing semicolon and the missing echo we get valid PHP code - let's see how the output will look like:
<html>
<head>
<title>Test</title>
</head>
<body>
<script>
function test(result)
{
var x = `\\`+ result+`\\`;
console.log(x)
}
</script>
</body>
</html>
At this point PHP sends the output to the client. Since I used the strtolower function there is no change here that breaks the code, the only thing the test function will do is to wrap the result in double-backslashes, but if I had used strtoupper the test function would fail because RESULT is undefined. I imagine that the decrypt_url function is not supposed to just wrap the input in back-slashes but it will transform the input in a more complex way, which will most likely completely break the resulting code so that the page can't be loaded.
I hope this makes a bit clearer why this approach can not work.
