Replacing double-quotes--form choking on html

Anon

I've got a form setup that's choking when displaying html to edit.
The problem is the double-quotes--eg:<font size="5">.
I'd like to replace the double quotes with &quot or something to store in table and replace back in on display. Problem is, the str_replace function won't work when trying to replace double-quotes.
Anyone have a solution for this?

Anon

str_replace will work just fine on double-quotes if you escape them properly.

$buf = str_replace("\"", "BOBSNOTYOURUNCLE", $buf);

But I am puzzled as to why you are having problems. If your system is set up properly (read the manual pages on magic quotes) you shouldn't have to be worrying about quotes coming in from form variables. Post some example code.

You are welcome to download and inspect the sources for my message board software: http://stonemountain.yi.org/

Anon

I gave that a shot and I get the error..
Warning: Unexpected character in input: '\' (ASCII=92) state=1 in newsadd.inc on line 16

Here is a sample of my code...
$header = str_replace("\"","&quot",$header);
$text = ($text);
$add_string ="INSERT INTO $tablename VALUES('',$header,$text)";

Anon

Hmm, if you don't have magic quotes turned on (and can't because
you don't "own" the server) you can always use addslashes() and
stripslashes(). This is the very definition of tedious, however, so
I recommend you get magic quotes turned on if you can.

As far as your code, I have some difficulty understanding two
things:

(1) $header = str_replace("\"",""",$header);

It sure looks to me like that second argument is three consecutive
double-quotes (and it cut-and-pastes like that, too.) This should
provoke some kind of parsing error. Did you perhaps mean to say
" ' " instead?

(2) $text = ($text);

What is this line supposed to accomplish?

Anon

Yes, (1) was a typo--the line should read--
$header = str_replace("\"","'",$header);

Please disregard (2) -- $text = ($text);
Line (1) is what I'm concerned about.