putting a php variable in a HTML form value

Question

I've got a php variable like so.. $name = $_REQUEST['name']; I'd like to put it in a HTML form field's value e.g in here.. <input type="text" name="name" value=(php variable here) /> How would I do so?

Thanks.

Quentin · Accepted Answer · 2010-07-23 11:35:23Z

45

value="<?php echo htmlspecialchars($name); ?>"

answered Jul 23, 2010 at 11:35

Quentin

949k136 gold badges1.3k silver badges1.4k bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Rich Adams · Accepted Answer · 2010-07-23 11:35:28Z

10

You can do it like this,

<input type="text" name="name" value="<?php echo $name;?>" />

But seen as you've taken it straight from user input, you want to sanitize it first so that nothing nasty is put into the output of your page.

<input type="text" name="name" value="<?php echo htmlspecialchars($name);?>" />

answered Jul 23, 2010 at 11:35

Rich Adams

26.7k4 gold badges43 silver badges62 bronze badges

3 Comments

Quentin Over a year ago

Short tags are deprecated and that opens up a lovely world of XSS (since $name is clearly indicated as user generated content in the code provided in the question)

Rich Adams Over a year ago

Thanks, I noticed the sanitizing once I'd answered and was already updating when you posted this comment ;) I've updated my answer to remove the short tags after your comment though. I know they're deprecated, but I still use them so it was just automatic to type it out that way.

user3148596 Over a year ago

That isn't properly sanitized. Quotes are still allowed and you didn't set the character set.

Collectives™ on Stack Overflow

putting a php variable in a HTML form value

2 Answers 2

Comments

3 Comments

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

3 Comments

Linked

Related