Problem with " in my database

[MichaelHe]

Hi

I have a big problem with " in a database.

In a normal varchar field I have a text containing the charater "
When I get this data on my site everything is normal and the " is shown as it should.

But...

When I go to a page where I change my data it gets the data like this $kbeskrivelse=$_POST['KBeskrivelse'];
And in a form field I type:
<input type="text" name="KBeskrivelse" value="<?echo $kbeskrivelse;?>">

The problem is that everything after the " is missing in the field.
So when I click update the database is updated with the rest of the data missing.

So problem is only in the input field it is missing. Everywhere else it's there.

I think maybe the problem is that in the field the html comes value="some text "somthing" and more text" and this is not correct html.
But how to do this.

I have tried addlashes and striplashes and so on, but I can get it to work ?

Does anyone have an idea

best
Michael

[dagon]

addslashes should work but mysql_real_escape_string is what you really want

[MichaelHe]

Thanks for your reply

Where should addslashes be placed ?

If I type value="<?echo addslashes($kbeskrivelse);?>" it just prints
some text \
on the screen, when the data is
some text "somthing" and more text

[NogDog]

I think the actual issue is a HTML problem, which can be solved by filtering the output via [man]htmlspecialchars/man or [man]htmlentities/man:

<input type="text" name="KBeskrivelse" value="<?php 
echo htmlspecialchars($kbeskrivelse, ENT_QUOTES); ?>">

Such filtering should be done to all HTML output of data from external sources (including databases), unless said data is supposed to contain special characters in HTML.