Escaping double quotes when displaying text

[Claus Mygind]

I have an array value of let's say

20" below grade

or I might have a value like

8' above grade

Because the value property is delimited with ", the following code cuts off the quote and trailing text when streamed out like this

<td><input type="text" name="Description" value="<?php echo $thisValue; ?>"></td>

Of course I could just change it to single quotes and I would be ok until the user types in the second option.

Perhaps this is a HTML question, but how can I escape the double quote so it will properly stream out?

I tried escaping the the double quote with the \ as in "20\" below grade", but that just outputs 20\.

any suggested help would be appreciated.

[Claus Mygind]

Ok I get it now

http://php.net/manual/en/function.htmlspecialchars.php

this fixes the problem as in

<td><input type="text" name="Description" value='<?php echo htmlspecialchars ( $thisValue); ?>></td>

[Dormilich]

I might add that there are special characters for minute (prime, U+2032) and second (double prime, U+2033), which hardly anyone knows they exist.

PS. there is a nice graphic in the german wiki that shows the differences between prime, typographical & straight apostrophe and the acute accent.

[Claus Mygind]

Thanks for that insight. I sure hope they don't use any of those characters like ` and ~

[solutionwand]

Hi,
Please check the str_replace function too for this issue.

http://php.net/manual/en/function.str-replace.php

I hope this is helpful for you.

[Claus Mygind]

Hi,
Please check the str_replace function too for this issue.

http://php.net/manual/en/function.str-replace.php

I hope this is helpful for you.

While you can do as you suggest, this is really a poor option and requires additional coding (see both my question and my own response to the question). By replacing the double quote you then also have to replace when retrieving the information.

Keep in mind the conflict is only because the double qoute is serving double duty as the wrapper for the content as well as being part of the content. And the wrapper is discarded when the content is stored in the data table, so why change the content for the sake of the temporary wrapper. Escaping the character instead of replacing it let's you preserve the use of the temporary wrapper without altering the content. That is to say it is being done behind the scenes for the programmer. Just like the wrapper is a temporary use item, so is the escaping. Escaping is a temporary replacing that is reversed once the content has been received by the data server. Therefore requiring less code and the need to reinvent the wheel.

[Atli]

I always preferred htmlentities over htmlspecialchar s myself, because it encodes all characters that have a corresponding HTML entity, rather than just those 5 special chars. It may not really be an issue on 99% of HTML pages (it'll matter more on XML/XHTML pages), but it's not like it's costing any extra effort or measurable performance.

Why not go all the way, when it's no more difficult than only doing as little as possible?