echoing quotes within an input form - help

[pedrotuga]

I am tring to use this code

$query=$_GET["query"];
<input maxlength=2048 size=70 name="query" value="<?php echo "$query"; ?>" title="search">

but i came to a problem. If $query has quotes only a escape slash shows on the input field...

i tried stripslashes() but then it mixed up the html around...
i cant thing of anything else...

[laserlight]

You are looking to use [man]htmlspecialchars/man or [man]htmlentities/man.

<input maxlength="2048" size="70" name="query" value="<?php
if (isset($_GET["query"])) {
	echo htmlspecialchars($_GET["query"]);
}
?>" title="search">

But shouldnt $_POST be used here instead?

[pedrotuga]

nop... its a seach filed... i want the users to be able to post urls with get values on it like:

http://mysite.com/search?query=blablablala

[pedrotuga]

i thought about a little fix that can avoid validation issues...

<input maxlength="2048" size="70" name="query"<?php
if (isset($_GET["query"])) {
    echo "value=\"".htmlspecialchars($_GET["query"])."\" title=\"search\""
}
?>