8

I have a value ($title) that is stored in MySQL and is being called, using PHP, to be inserted into the value of an input element. The problem is when a single or double quote is used, the value of the input field terminates at that point.

The behavior that should occur is the input field should be populated EXACTLY with the data in the $title variable, so that when the form is updated, the quotes remain intact.

Here is the PHP:

<?php
    echo '<input type=text size=91 name=title value="'.stripslashes($title).'">';
?>

Now, here is a typical problem: if the value of $title

this is a test " of what occurs with a quote

and I echo the variable, it echos correctly to

this is a test " of what occurs with a quote

However, when used in an input field, it renders as:

<input value="this is a test " of what occurs with a quote">

The first " terminates the value of the field, causing the new value to be:

this is a test 

I'm confused as to how to get the proper value to display and be submitted with the form, when that variable is displayed and updated.

0

5 Answers 5

13

Try using htmlspecialchars. This will escape the " in yout title.

value="'.htmlspecialchars($title).'">
9
  • This is excellent! Now how to I get it to not error out if an apostrophe is inserted into the input field?
    – dihakz
    Jun 11, 2013 at 15:19
  • I don't fully understand your comment. What error do you get when inserting an apostrophe.
    – cb0
    Jun 11, 2013 at 15:22
  • 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'This is the description updated "with" quotes', date_of_call='06/11/2013', time_' at line 1
    – dihakz
    Jun 11, 2013 at 15:24
  • 1
    That's an SQL error, meaning you're WIDE OPEN to sql injection attacks. Do NOT use this buggy code in production, or your server + site are going to get utterly destroyed.
    – Marc B
    Jun 11, 2013 at 15:32
  • 1
    No... don't use htmlspecialchars when inserting data into the database. Use mysql_real_escape_string instead. Jun 11, 2013 at 15:35
2

Put a \ before the quote.

echo "This is a \" test";

1
  • I had a similar case, I did not need to use htmlspecialchar or stripslashes or addslashes, simply escaping the quotes or double-quotes surrounding the variable for the value.
    – Kim Wilson
    Jul 23, 2020 at 2:20
1

Change this line.

<input type=text size=91 name=title value="'.stripslashes($title).'">

To

<input type=text size=91 name=title value=\''.stripslashes($title).'\'>
1
  • then use htmlspecialchars with that. Jun 11, 2013 at 15:26
0

Why are you running stripslashes()? Running addslashes() (the opposite function) would fix this particular issue, but a better approach would be to use htmlentities($title, ENT_COMPAT, 'utf-8') everywhere you output the title (or, if your structure allows, when the data is stored).

1
  • When I try this, I get only 'This' in my input field, when the value of $title is actually 'This is a test of the title field. It contains a double quote " " "' (single quote is not actually part of the strings, I only used that to show where the string started and ended.)
    – dihakz
    Jun 11, 2013 at 15:26
0

After you perform stripslashes you should use htmlspecialchars to escape the special characters. This avoids the mess the characters like ",', etc might otherwise create.

<input type=text size=91 name=title value="'.htmlspecialchars(stripslashes($title)).'">

The above snippet will only fix it for display purpose. But when the submit happens you must use either mysql_real_escape_string() or $pdo->quote() to escape the special characters before you run the SQL query.

7
  • This, too, works. However, I'm getting a MySQL error when an apostrophe is used in the input box. Any idea how to clear that up?
    – dihakz
    Jun 11, 2013 at 15:21
  • htmlspecialchars above only escapes the data for display purpose. before performing an insert into MySQL, perform htmlspecialchars again.
    – Kalyan02
    Jun 11, 2013 at 15:34
  • No no no. Don't use htmlspecialchars to insert into the database. Ugh. Horrible horrible advice. Jun 11, 2013 at 15:41
  • @dihakz @bobwienholt is correct. You should instead use mysql_real_escape_string() or $pdo->quote()
    – Kalyan02
    Jun 11, 2013 at 15:51
  • Thank you all for the help -- now I'm just trying to get my value submitted to escape single quotes for insertion into the database. Then I'm golden! :-)
    – dihakz
    Jun 11, 2013 at 15:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.