Help with PHP and Hidden Fields

[golfinggod]

Hi does anyone know how to change this so that the Hidden fields echo out the complete string. For example the "address" input should have say "123 My street" instead it only iutputs the "123" and misses the "My Street".

Some mentioned that it may be because I am not placing quotes around the "hidden" input type.

Can anyone help

if 	($error != 1)
	{  

 echo "<form name=form1 method=post action=https://sslrelay.com/hartsnursery.co.uk/Reciept.php>
 <input name=Submit type=submit class=Checkout value=Complete>
( Click To Proceed )<strong>
<input name=FirstN type='hidden' value= $firstname >
<input name=LastN type=hidden value= $Lastname >
<input name=Address type='hidden' value= $Address >
<input name=Town type=hidden value=$Town >
<input name=Post type=hidden value= $Post  >
<input name=Telephone type=hidden value=  $Telephone   >
<input name=CardH type=hidden value=$CardH >
<input name=CardN type=hidden value=$CardN  >
<input name=Type type=hidden value=$Type >
<input name=Issue type=hidden value=$Issue  >
<input name=Start type=hidden value=$Start >
<input name=Expiry type=hidden value= $Expiry  >
<input name=Security type=hidden value= $Security  >
<input name=Items type=hidden value= $items  >
<input name=TotalCost type=hidden id=Items value= $_POST[TotalCost] >
<input name=Ordern type=hidden id=Items value= $saleid >
<input name=Email type=hidden id=Items value= $Email >
</strong>                                  

</form> ";
}
else

[ozzythaman]

yes, it's because of the quotes

write
<input name=FirstN type='hidden' value=\"$firstname\">

or nicer with single quotes

<input name=FirstN type='hidden' value='$firstname'>

[Weedpacket]

You forgot to quote the name attribute as well. And you forgot that names and addresses might contain quotes.

if     ($error != 1)
    {
?>
<form name="form1" method="post" action="https://sslrelay.com/hartsnursery.co.uk/Reciept.php">
<input name="Submit" type="submit" class="Checkout" value="Complete">
( Click To Proceed )<strong>
<input name="FirstN" type="hidden" value="<?php echo htmlspecialchars($firstname)?>">
<input name="LastN" type="hidden" value="<?php echo htmlspecialchars($Lastname)?>">
<input name="Address" type='"hidden"' value="<?php echo htmlspecialchars($Address)?>">
<input name="Town" type="hidden" value="<?php echo htmlspecialchars($Town)?>">
<input name="Post" type="hidden" value="<?php echo htmlspecialchars($Post)?>">
<input name="Telephone" type="hidden" value="<?php echo htmlspecialchars($Telephone)?>">
<input name="CardH" type="hidden" value="<?php echo htmlspecialchars($CardH)?>">
<input name="CardN" type="hidden" value="<?php echo htmlspecialchars($CardN)?>">
<input name="Type" type="hidden" value="<?php echo htmlspecialchars($Type)?>">
<input name="Issue" type="hidden" value="<?php echo htmlspecialchars($Issue)?>">
<input name="Start" type="hidden" value="<?php echo htmlspecialchars($Start)?>">
<input name="Expiry" type="hidden" value="<?php echo htmlspecialchars($Expiry)?>">
<input name="Security" type="hidden" value="<?php echo htmlspecialchars($Security)?>">
<input name="Items" type="hidden" value="<?php echo htmlspecialchars($items)?>">
<input name="TotalCost" type="hidden" id="Items" value="<?php echo htmlspecialchars($_POST['TotalCost'])?>">
<input name="Ordern" type="hidden" id="Items" value="<?php echo htmlspecialchars($saleid)?>">
<input name="Email" type="hidden" id="Items" value="<?php echo htmlspecialchars($Email)?>">
</strong>                                  

</form>
<?php
}
else  

Some of the htmlspecialchars() calls can be removed if you know that their values cannot contain anything that might break the HTML (in this case, particularly, " and >).

A couple of other things I noticed: only one element can have an ID of a particular name; you have three. And is it my imagination or are you allowing people to set their TotalCost to anything they feel like?