escaping '

[pradeepjain]

hii,
I am storing form data into database and later i gve admin the option of editing the content of it by means of a form ..there is a small problem with ' .ie when ever there is a date like test's in database....while fetching its fetches properly but while displaying its giving a prob like it just prints test and nothing after it the ' is giving a prob.
this is the php command ...any change needs to be make here

[PHP]print("<td><input name='Description' type=text size=80 value='" . $test[$nr][Description] . "'></td>");[/PHP]

this displays only test

but if i give print_r($test[$nr][Description]);
its displays full test's

wht changes need to be made in print statement..


Thanks,
pradeep

[dlite922]

hii,
I am storing form data into database and later i gve admin the option of editing the content of it by means of a form ..there is a small problem with ' .ie when ever there is a date like test's in database....while fetching its fetches properly but while displaying its giving a prob like it just prints test and nothing after it the ' is giving a prob.
this is the php command ...any change needs to be make here

[PHP]print("<td><input name='Description' type=text size=80 value='" . $test[$nr][Description] . "'></td>");[/PHP]

this displays only test

but if i give print_r($test[$nr][Description]);
its displays full test's

wht changes need to be made in print statement..


Thanks,
pradeep

MySQL will always return what you query it at. What you gave us, was not MySQL but the PHP code to display the result.

What's your query?

But that's besides the point, You INSERTION into the database is wrong.

Please use mysql_real_escape_string() function on all variables before inserting them into the MySQL database. (If MySQL is what you're using)

Let us know,



Dan

[pradeepjain]

Hey in database its storing properly ..but while displaying its not displaying.this is the display command.

[PHP]print("<td><input name='Description' type=text size=80 value='" . $test[$nr][Description] . "'></td>");[/PHP]

in this its giving problem..

thanks,
Pradeep

[Atli]

The problem there is that you are creating invalid HTML output.

That is, consider this:

<?php
$string = "Test's";
echo "<input type='text' value='$string' />";
 
# Produces:
#  <input type='text' value='Test's' />
?>
 

As you see, the apostrophe in Test's is causing the value of the "value" parameter to close early, leaving s' outside it. *Luckily* most browsers will recover from this syntax error and only show "Test".

What you need to do is escape the extra apostrophe, so the browser will know it is not meant to close the string.

<?php
$string = str_replace("'", "\\'", "Test's");
echo "<input type='text' value='$string' />";
 
# Produces:
#  <input type='text' value='Test\'s' />
?>
 

Which should be rendered correctly by the browser.

[pradeepjain]

Is there any other way of doing it bcos my lot many forms are running and i need to do it faster..

[Gulzor]

try to output the value using htmlentities() and the ENT_QUOTES param.

[php]
<?php
echo '<input name="foo" type="text" value="',htmlentities($str, ENT_QUOTES),'" />';
?>
[/php]

also look at htmlspecialchars(), it may help.

[pradeepjain]

thanks a lot both of them work fine..

[PHP]<?php
function htmlspecialchars_array($arr = array()) {
$rs = array();
while(list($key,$val) = each($arr)) {
if(is_array($val)) {
$rs[$key] = htmlspecialchars_array($val);
}
else {
$rs[$key] = htmlspecialchars($val, ENT_QUOTES);
}
}
return $rs;
}
$test=htmlspecialchars_array($test);
?>
[/PHP]



i used this script so tht it checks at the beginning!!!!..


thanks