[RESOLVED] Problem with Quotes and HTML

tony_l

I have an application I am working on that allows users to enter a description into a form and submit it to our MYSQL database.

I send the entered information through stripslashes (because of magic quotes being enabled), then we send it through mysql_real_escape_string() so it is safe for the Database.

That works well.

BUT

I have an edit form that Administrators are supposed to use in order to correct information if the user calls in. The problem is I select the information out of the database and populate the fields in the form with the value that is in the database like so -

PRINT("

<input type = 'text' name = 'description' value = '$userObject->description'>

");

Now, we have noticed this problem that is driving us nuts. If the information from the database is:

Children's Hospital

The database stores it as

The Children/'s Hospital

(Like it should be)

I use this to strip out the slashes -

$userObject->description = stripslashes($userObject->description);

BUT....

The form displays it as : The Children (with nothing else there)

This is due to the quote that is in the string after children

How do I overcome this? I need it to display the quote in the field for accuracy. I have tried this as well -

$userObject->description = htmlentities($userObject->description);

AS WELL AS

$userObject->description = htmlspecialchars($userObject->description);

Any suggestions?

NogDog

With htmlentities or htmlspecialchars(), add the 2nd optional parameter with a value of ENT_QUOTES, e.g.:

$userObject->description = htmlentities($userObject->description, ENT_QUOTES);

Scriptmaker

the form html doesn't like the single quote in The Children's Hospital, it handles it like this:

Just add some \" around the variable and give that a shot.

PRINT("

<input type = 'text' name = 'description' value =\"$userObject->description\">

");

NogDog

Scriptmaker wrote:
the form html doesn't like the single quote in The Children's Hospital, it handles it like this:

<input type='text' name='description' value='The Children'>

Just add some \" around the variable and give that a shot.
PRINT("

<input type = 'text' name = 'description' value =\"$userObject->description\">

");

However, you might still run into the same type of problem then if the content has a double-quote in it. Using the htmlentities($content, ENT_QUOTES) method will replace all quotes in the content with their corresoponding HTML entity, allowing it to work regardless of any quotes in the content.

Kudose

Agreed.

tony_l

Ok that solved the problem!

I guess I should have looked at the htmlspecialchars() function a little more closely.

Thank you for your help!