Escaping quotes in a form field 1

[jimoblak]

I've got a form field that is filled with data from MySQL. The form is an editor of previously recorded data.

<INPUT name=changeTitle value=\&quot;$Row[Title]\&quot;>

I just realized that it does not work when someone uses quotation marks in their entry.

If the Title was "My Fair Lady" presentation, the HTML would look like:

<INPUT name=changeTitle value=&quot;&quot;My Fair Lady&quot; presentation&quot;>

This HTML results in a blank field because the browser sees 2 quotation marks next to each other.

If I change the PHP to:

<INPUT name=changeTitle value=$Row[Title]>

(removing the escaped quotation marks) then presentation does not appear in the text field.

Can anyone recommend a way around this? Should I simply deny the ability to use quotation marks when the data is first entered?

It seems that single quotes are fine. How do I replace double quotes with single quotes when the data is first entered? The following does not work...

$newTitle = preg_replace ("\"", "\'", $_POST[newTitle]);

- - picklefish - -

Why is everyone in this forum responding to me as picklefish?

 

[DRJ478]

I suggest you replace the offending characters with their HTML entities:

http://www.php.net/manual/en/function.htmlspecialchars.php

 

[jimoblak]

Wow - it's like those gearheads at PHP.net wrote the manual just for me. I feel special .

Thanks for the direction.

- - picklefish - -

Why is everyone in this forum responding to me as picklefish?