Trouble parring single quote through post into table

[pioneerx01]

In one of my forms I am calling on all items stored in one table:

 

$query  = "SELECT item FROM item_table WHERE ";
$result = mysql_query($query);
while($row = mysql_fetch_array($result, MYSQL_ASSOC))
{echo "<option value='{$row['item']}'>{$row['item']}</option>";}

 

So, basically I get a drop down menu with choices such as: Bob's Pen, Tom's Pencil, Mark's Paper,...

Users get to select one and submit that form which goes into table, but nothing after the quote gets stores so I get: Bob, Tom, Mark,... I know that ' and everything after that gets filtered out because when I directly echo the post I get what is submitted into the database (Bob, Tom, Mark, ...). Will I have to replace ' with something else as it gets submitted and then replace something else back to ' right before it gets stored into a table? Or is there a way I do not know of as to how to do it?

 

Thanks

[MasterACE14]

try changing...

{echo "<option value='{$row['item']}'>{$row['item']}</option>";}

to...

{echo "<option value='".$row['item']."'>".$row['item']."</option>";}

[trq]

try changing...

{echo "<option value='{$row['item']}'>{$row['item']}</option>";}

to...

{echo "<option value='".$row['item']."'>".$row['item']."</option>";}

 

Why? They are essentially the same. There is nothing wrong (syntax wise) with the original code.

[PFMaBiSmAd]

When you output content (everything that is not specifically HTML markup) on a web page, you need to use htmlentities with the second parameter set to ENT_QUOTES so that any characters in the content that have significance in HTML won't break the HTML syntax on your page.

 

[pioneerx01]

PFMaBiSmAd Thank you it worked.

 

$item = htmlentities($row['item'], ENT_QUOTES, 'UTF-8');
echo "<option value='{$item}'>{$item}</option>";