Re: Re: How to escape apostrophe in HTML textbox exactly???
| From: | Torsten Roehr | Date: | Wed, 30 Jun 2004 17:32:01 +0000 |
| Subject: | Re: Re: How to escape apostrophe in HTML textbox exactly??? | ||
| References: | 1 2 3 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-189320@lists.php.net to get a copy of this message | ||
"Justin Patrin" <papercrane@gmail.com> wrote in message
news:432beae0406301019713ee3dd@mail.gmail.com...
> On Wed, 30 Jun 2004 19:02:50 +0200, Torsten Roehr <roehr@zilleon.com>
wrote:
> >
> > "Scott Fletcher" <scott@abcoa.com> wrote in message
> > news:20040630165221.37283.qmail@pb1.pair.com...
> > > I'm using data that goes from the HTML textbox to PHP to MYSQL to PHP
to
> > > HTML textbox. The only trouble I have is to escape the apostrophe
> > character
> > > when it is put into the HTML textbox by PHP (from MySQL).
> > >
> > > --snip--
> > > echo "<input type='textbox'
> > > value='".$value."'>";
> > > --snip--
> > >
> > > I can't use the HTML feature like " or something because the
"""
> > > would show up in the database... Any suggestion or advice?
> >
> > You CAN use " - convert your data AFTER getting it from the DB.
When
> > you submit the form the " will be automagically converted back to a
"
> > in the POST data. I recommend writing a function you run on all data for
> > outputting as HTML with htlmentities().
> >
> > 1. get data from DB
> > 2. convert for valid HTML output (stripslashes(), htmlentities())
>
> You shouldn't need stripslashes when getting something out of the DB.
> You also shouldn't need addslashes when putting it in. quoteSmart() in
> PEAR::DB is a *much* better option.
The last time I tried PEAR::DB 1.6.4 quoteSmart() didn't work for me. It
corrupted my statement. Maybe I should try again ;)
Torsten