How to escape MS-SQL output in html/php?

Question

Sounds very simple, but I'm kinda confused at the moment.

I have this DB object which includes some values that I want to output in an html form.

Simplified Problem: $result is my db object and this is the html input where I want to output some text which can include double or single quotes.

<input class="someclass" name="desc" id="descID" type="text" value="<?=$result['desc'];?>" placeholder="<Description>" />

So if $result['desc'] contains text like this: 'Did you hear about "foobar"?' everything after the first double quote gets cut off and ends up like this: 'Did you hear about '.

What i have tried already without success:

htmlspecialchars like this value="<?=htmlspecialchars($result['desc']);?>" or like this value="<?=htmlspecialchars($result['desc'], ENT_QUOTES);?>"
addslashes

Note: My DB(mssql) saves the string properly. Only have the problems in my html.

I would be glad if you could help me out here. Thanks.

<?php $t = 'Did you hear about "foobar"?'; ?> <input class="someclass" name="desc" id="descID" type="text" value="<?= htmlspecialchars($t);?>" /> work likes charm!! — Parixit
– Parixit, Commented Mar 1, 2016 at 13:32
These double quotes around foobar were inserted like this in your DB? If so, escape them before displaying the string. — Edvaldo Silva de Almeida Jr
– Edvaldo Silva de Almeida Jr, Commented Mar 1, 2016 at 13:49
ok so i tested those, and the solution of @Parixit seems to work, BUT only if i actually type <?php $t = 'Did you hear about "foobar"?'; ?>. i tried <?php $t = $result['desc']; ?> and it didn't work — Charly H
– Charly H, Commented Mar 1, 2016 at 13:49
@EddeAlmeida my DB saves the text literally as Did you hear about "foobar". And your suggestion is exactly what I'm trying to do here. — Charly H
– Charly H, Commented Mar 1, 2016 at 13:58

Charly H · Accepted Answer · 2016-03-01 14:22:21Z

1

Thanks for the help so far, but i managed to find a solution to this:

<?$descEscaped = str_replace('"', '&quot;', $result['desc']);?>

<input class="someclass" name="desc" id="descID" type="text" value="<?= htmlspecialchars($descEscaped);?>" />

answered Mar 1, 2016 at 14:22

Charly H

1679 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Hink · Accepted Answer · 2020-03-11 12:17:46Z

0

htmlspecialchars replaces quotes with """.
I am using my simple function htmlliteral:

function htmlliteral($s){
     return '"'.htmlspecialchars($s).'"';
}

With this function you can use:

$descEscaped = htmlliteral($result['desc']);
print "<input class=someclass name=desc id=descID type=text value=$descEscaped />";

answered Mar 11, 2020 at 12:17

Hink

1,1031 gold badge15 silver badges31 bronze badges

Collectives™ on Stack Overflow

How to escape MS-SQL output in html/php?

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related