Originally posted by laserlight
again, double quotes should be used to enclose the values of the input tags.
you should also use htmlspecialchars() on those values, including the textarea.
print is equivalent to echo except that print may return a boolean value.
I second the use of htmlspecialchars(), it's absolutely neccessary from what I've practiced.
I also embed striplashes() inside it too.
value="<?php htmlspecialchars(stripslashes($string)); ?>"
To cut down on keystrokes I created a class called Input (among other form tools) that can be called by saying:
$input = new Input($type, $name, $value, $size, $maxlength, $tabindex, $selected);
where the 'value' attribute is always sent through htmlspecialchars() and stripslashes(). I have had great success with this method. There is an echo statement inside the constructor that prints the input tag with all of the values specified. Values can be passed as a variable, string or null:
$input = new Input("submit", null, "Send Form", null, null, $i, null);
echos in the source code:
<input type="submit" name="" value="Send Form" size="" maxlength="" tabindex="15" />
for example.