Dangerous charicters II

[Anon]

I am using
<input type='text' name='fname' value='$fname' size='25'>
so people can edit the feild

is there a way that I can make it so that all chrictors will display if they are in the variable?

ie

$fname = 'I have an ' so everything after it will not show because the browser sees the following'

<input type='text' name='fname' value='I have an ' so everything after it will not show because the browser sees the following' size='25'>

then it outputs to the user

I have an

[Anon]

<input type='text' name='fname' value='addslashes($fname)' size='25'>

[Anon]

that outputs for the user

addslashes(Travis)

because $fname = Travis

in other words it is not preforming the function... it is actually just printing out what I put there..... what else can I do?

Louie wrote:

<input type='text' name='fname' value='addslashes($fname)' size='25'>

[Anon]

Try:
<input type='text' name='fname' value='<? print addslashes($fname);?>' size='25'>

[Anon]

how it is set up now is
<?
a whole bunch of phpstuff
echo
9"a whole bunch of html

<input type='text' name='fname' value='addslashes($fname)' size='25'>
");

so again I still am left unanswered

[Anon]

The right way to safely output any characters to an HTML stream is using htmlentities(), not addslashes() :

<input type='text' name='fname' value="<?php print htmlentities($fname); ?>">

You also have to use " and not ' around the value.