[RESOLVED] String didnt echo completely

kingdm

I fetch a value from my database table named 'spouse' which has a value of "Elizabeth Jik", and stored it in a session variable named $_SESSION['spouse'].

Now I try to output the value in a input type text field. Here is my code:

<?php
session_start();
$spouse = $_SESSION['spouse'];
if($_SESSION['cstatus'] == 'Married')
		{
			$display_spouse = "<input type=\"text\" name=\"spouse\" maxlength=\"80\" value=".$spouse." >";
		}
?>
<html>
.
.
.
<div>
<?php echo $display_spouse; ?>
</div>
.
.
.
</html>

The code works and it does output a value, however, it only prints Elizabeth. The surname Jik is missing. Why is that?

laserlight

You forgot to quote the attribute value in the form element. You also forgot to apply htmlspecialchars() or htmlentities() to the value.

kingdm

laserlight;10937697 wrote:
You forgot to quote the attribute value in the form element. You also forgot to apply htmlspecialchars() or htmlentities() to the value.

Thanks for the quick reply laserlight. I finally got it working after taking a close look on my attribute value. I've change the code to:

$display_spouse = "<input type=\"text\" name=\"spouse\" maxlength=\"80\" value=\"$spouse\" >";

Thanks also for reminding me in applying htmlspecialchars() function.

dagon

a little less typing, and less likely to make a mistake, use single quotes:

$display_spouse = '<input type="text" name="spouse" maxlength="80" value="'.$spouse.'" >';

NogDog

Or use double quotes for the PHP string literal and single quotes for the HTML attribute values, and save two more keystrokes (no need for the concatenation operators).

$display_spouse = "<input type='text' name='spouse' maxlength='80' value='$spouse'>";

laserlight

NogDog wrote:
Or use double quotes for the PHP string literal and single quotes for the HTML attribute values, and save two more keystrokes (no need for the concatenation operators).

However, in such a case you should pass ENT_QUOTES as the second argument to htmlspecialchars() and note that variable interpolation tends to be very slightly slower than concatenation. The former would not matter if you define your own escaping function wrapper, and the latter does not usually matter unless you want to squeeze every last drop of efficiency from the code.