Re: Fixed Quote Marks in Inputs

Bogdan Stancescu wrote: > Ok, finally found a valid argument! :-) > > What if the user enters "I'm aware that 2>3!"? > > Bogdan Tested it - it works. However, you'll have big problems if you'll ever need to echo the data. Consider this example: Enter description: <input box> The user enters "Edited by Bogdan's wife <mgv@fx.ro>". You now want to store this. You'll first use your algorithm to convert the ' into &#039;. You store the result in the database. Now you want to display this data. You retrieve "Edited by Bogdan&#039;s wife <mgv@fx.ro>" from the database. What next? You can't simply echo this because that would apparently omit "<mgv@fx.ro>". You can't htmlspecialchars() either because that would result in "Edited by Bogdan&amp;#039;s wife &lt;mgv@fx.ro&gt;" which is not right. So there, that's why you should store the text as everybody else does. :-) Bogdan