"Double Quotes" causing script failure...

[darthmahon]

Hey guys,

Ok got a problem when using "double quotes".

I've got a form that addslashes to all data put into a database if magic_quotes is set to off - this works fine, I know for sure.

Now I put the following in one of the fields in my form:

Testing "hello"

In the database I can see the following:

Testing "hello"

Ok, great but when I try to echo this value in an input field within a form I get the following:

Testing

Where is the "hello" bit? This is what my input field looks like:

<input name="name" id="name" size="40" value="<? echo $row['fld_name']; ?>" />

I've tried to echo the entire input form but it still doesn't display the rest of the value - any ideas? It works fine if I just echo the value outside of an input field.

Cheers,
Chris

[laserlight]

You should use [man]htmlspecialchars/man on such data to be written to a form input element.

[bodzan]

...htmlspecialchars() as laserlight suggested, but use it before you enter this kind of data to the MySQL...

[darthmahon]

ahh - gotcha, thanks for the help.