Escape quotes in a variable with PHP

Question

I use this code to genefate html

echo \"\";

Everything would be OK unles

Answer 1

If you are relying on user input, use htmlentities($param, ENT_QUOTES);

See http://uk.php.net/manual/en/function.htmlentities.php

Answer 2

There are a couple of functions that could be used:

<?php
$string = 'string test"';

echo htmlentities($string) . "\n";
echo addslashes($string) . "\n";

They produce the following:

string test"
string test\"

Answer 3

This works for me...

echo '<a href="#" onclick="showTable(&#039;'.$table.'&#039;)">'.$table.'</a>';

It's not necessary to use backslaches for escaping when using single quote for echo. Single quote have my vote to work with both php and javascript + html tag.

Answer 4

Whenever thinking about escaping, you always need to ask
"In which context do I want to escape?"
Because escaping is essentialy making sure the input is not interpreted in the special meaning of the target, but literaly

Do not use addslashes, since it's contextless

If you are inserting the string into HTML, use

htmlspecialchars($argument, ENT_QUOTES)

as mentioned.

The onclick content part is technicaly JavaScript, so it might be appropriate to escape the content with json_encode (it's side-effect is JavaScript-specific escaping). Similarly should you have style attribute, you'd want to escape the content with

addcslashes($s, "\x00..\x2C./:;<=>?@[\\]^`{|}~")

(source: http://translate.google.com/translate?u=http%3A%2F%2Fphpfashion.com%2Fescapovani-definitivni-prirucka&ie=UTF8&sl=cs&tl=en)

Summary
Use

$param = htmlspecialchars(json_encode($param), ENT_QUOTES)

and then you can safely include it into the HTML string

Answer 5

As Damien said; use addslashes :)

$param=addslashes($param);
echo "<input type='button' onclick=\"myFunc('$param');\" />";

Answer 6

first do

// only for the GUY who didn't read the complete answer :(
$param=addslashes($param); 

then write code in simple HTML

<input type='button' onclick="myFunc(<?php echo $param?>);" />

Note: mysql_real_escape_string works when we handle with mysqltry with addslashes