23

In my PHP project I have a value containing special characters like ",', etc. (" 5 " inches, '3.5' inches, etc.). But it does not appear in a text field. How can I display this?

Is it possible to display this value in a text box?

9 Answers 9

97

Use htmlentities:

<input value="<?php echo htmlentities($value);?>">
5
  • 3
    What if you want to save this values not enconded in the database? You have to apply each time html_entity_decode(); before doing the SQL INSERT ? That doens't sound good
    – dynamic
    Nov 27, 2012 at 20:27
  • 4
    yes123, no, you don't. This encoding will ensure the values are correct in the HTML document. The web browser will automatically send it in the correct, normal format. Nov 28, 2012 at 7:13
  • 1
    better to combine with stripcslashes()
    – Raptor
    Jul 16, 2013 at 3:52
  • 2
    Shivan, there is no reason to strip any slashes here. What you want to do is encode the string for HTML view, you don't need to do any other filtering. Jul 16, 2013 at 5:00
  • If you want both single and double quotes to be able to go in, use the ENT_QUOTES flag htmlentities($value,ENT_QUOTES) Also, I recently ran into an issue with UTF-8, so depending on your needs, you may want to pass 'UTF-8' as the encoding (third parameter).
    – Jo.
    Mar 21, 2016 at 21:13
12

I suppose your "text box" is an HTML <input> element?

If so, you are displaying it using something like this:

echo '<input name="..." value="' . $yourValue . '" />';

If it's the case, you need to escape the HTML that's contained in your variable, with htmlspecialchars:

echo '<input name="..." value="' . htmlspecialchars($yourValue) . '" />';

Note that you might have to add a couple of parameters, especially to specify the encoding your are using.


This way, considering $yourValue has been initialized like this :

$yourValue = '5 " inches';

You'll get from this generated HTML:

<input name="..." value="5 " inches" />

To that one, which works much better:

<input name="..." value="5 &quot; inches" />
2
  • 2
    So what happens when you submit that input field? Will it go into a database like &quot; and then you'll have to convert it somewhere else? What if you want to submit it with the actual double quote in it.
    – Michael K
    Mar 14, 2012 at 14:59
  • +1 for being more descriptive, mentioning encoding and since htmlspecialchars() is enough.
    – DanMan
    Dec 2, 2013 at 14:26
8

For UTF-8 I went for htmlspecialchars($value, ENT_QUOTES, "UTF-8") which did the trick.

stack source

5

When using character set UTF-8, I use the code below to get Iñtërnâtiônàlizætiøn and double (or single) quotes right:

<input type="text" name="title" value="<?php echo htmlentities(stripslashes(utf8_decode($title))); ?>" />

PS: This is useful after someone submitted the form, but when the input is not validated.

1
  • I prefer to use stripcslashes() to preserve change lines.
    – Raptor
    Jul 16, 2013 at 3:52
2

I've found if you have double quotes in a variable in JavaScript (from Ajax/database whatever) and you want to put it in a field - if you build the whole field/form HTML content and then swap that into a div using innerHTML, the double quotes in the value will cause problems. I was doing this and I couldn't figure a way around it by escaping either.

You should build the HTML content with the field and swap it in first, and then do a document.getElementById('myfieldid').value = thevalue; instead and it works fine.

2
  • 1
    For a Javascript solution this worked and got me out of a jam. No one mentioned this thread needed to be in PHP. So I took away your -1. :) Thanks for figuring this out. Otherwise it would have taken me all night to fix a bug.
    – Paul
    Sep 9, 2016 at 3:00
  • Thanks :) It was a bizarre problem and I couldn't believe that escaping didn't work. Good to know it helped, and that I'm not the only one that had this pain of a problem.
    – Michael K
    Sep 14, 2016 at 15:44
1

I needed to apply htmlspecialcars() to the query result array. I found a useful solution from here (see the comment by sean).

// Create a cleaning function
function _clean(&$value) {
  $value = htmlspecialchars($value);
  //$value = htmlspecialchars($value, ENT_QUOTES); // Alternative
}

// Fetch the data from DB somehow (sqlQ is a custom function)
$q = "...";
$r = $d->sqlQ($q);
$row = mysqli_fetch_array($r, MYSQLI_ASSOC);

//...call the function recursively (not always necessary) to the resultset row
array_walk_recursive($row, '_clean');

It does quite a bit unnecessary work if you fetch only a few text columns, but at least you don't need to write the htmlspecialchars() function to the HTML form multiple times.

0

Try this

 echo '<input name="..." value="' . htmlspecialchars(stripslashes($yourValue)) . '" />';

or

<input name="..." value="<?php echo htmlspecialchars(stripslashes($value)); ?>">

Good luck ;)

0

Personally, I use this trick:

$s = str_replace("& amp ;", "&", (htmlentities(stripslashes($s), ENT_QUOTES, 'UTF-8')));
0

It looks like the best way to manage single and double quotes (and other special chars) with HTML input is mimicking it via textarea field. So just create a textarea instead of input field and give some styles to make it look like a native input.

<textarea class="fake-input"> quote's and other quote"s </textarea>
<style>
.fake-input {
    height: 20px; /* based on your font-size */
    resize: none;
    overflow: hidden;
    white-space: nowrap;
    width: /* your input width */
}
</style>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.