Andy got a good idea, but he forgot one thing... What happens if a user writes " or ' in a field and you echo that value in a hidden field ??
Example :
what do you like ? : [jello au "guili guili guili"]
If you echo that, simply, with no transformation...
<INPUT NAME="what_do_you_like" VALUE="jello au \guili guili guili\"" TYPE=HIDDEN>
The value parameter will be closed after the second " it will find, so value will be : jello au \
You also may have noticed the presence of \ : PHP automatically places \ before some specials characters such as " and '... What to do then ? This...
htmlentities(stripslahes($_POST["field_name"]));
Htmlentities() ? Replaces some characters with &...; ex :
< = <
= >
" = "
é = é
etc.
Here is a complete example...
<INPUT NAME="name" VALUE="<?= htmlentities(stripslashes($_POST["name"]));" TYPE=HIDDEN>
$POST ? It's an array that contains all posted variables and their values. Use it instead of $variable_name... it's more secure. But if you request method is GET (I don't know why you would use it with a form), use $GET.
Where is the "echo" ? <?= is the same thing than <? echo
Hope it will help you.