Re: How do I display apostrophe in PHP generated form?

On 29.11.2021 at 02:41, John wrote:

> Thank you very much for your reply.  Yes, addslashes() didn't resolve
> the problem.
>
> I am still trying to figure out why this should be an HTML issue since
> the echo command is only trying to place a known correct string in a
> specific place in the HTML statement.  I would have expected
> everything to be correct here with maybe a problem when I pick up the
> input later.

You're basically creating the following HTML:

  <input value='O'Really'>

This is obviously invalid; the apostrophe in O'Really needed to escaped
as &apos;.  Note that the HTML is not only invalid, but that missing to
escape user input on output is the main reason for XSS vulnerabilities.

> I'm reading the documentation for both of htmlspecialchars() and
> htmlentities() to try and figure it out since I want to understand the
> situation.

If you're going to produce UTF-8, htmlspecialchars() with the proper
arguments should be sufficient.  There's no need to generate HTML
entities for all those non-ASCII characters.

--
Christoph M. Becker