Echod variable with double quotes dies

[dothedew101]

OK. I've tried to figure this one out on my own, but if you do a search on the forums or Google for double quotes, all you get are the rules for when to use double and single quotes and info on magic quotes in your php.ini. This is different.

 

On 1 page I have a textarea on a form which I echo on the next page <? echo $variable; ?>. Simple enough. PHP 101. But, if someeone puts double quotes in the text area, say the shorthand for inches like in 12" subwoofer, What is echoed is 12\\\\ and nothing else. Everything after the double quotes is gone. If I do ?< echo stripslashes($variable); ?> then I get 12\\

 

This has me stumped. does anyone have a clue what is going on here. Now I'm paranoid that every form field I have is vulnerable to this. 

[V34]

Sorry if I have misunderstood you.

 

You can use <?php htmlentities($variable); ?>

 

It makes chars like " to " - Which is easily read by HTML.

[bobleny]

You could also search for things like that and add a /slash/ in front of them....

 

str_replace(", /", $problem_variable)

 

v34's way is probably better

[V34]

No - It's just different.

[dothedew101]

Thanks, but

 

<?php echo htmlentities($wordad); ?>

 

had no effect other than stripping two of the slashes. Output for 20" was 20\\

 

I'm using PHP 4.4.4 magic_quotes_gpc On - I've tried off as well - as well as stripslashes.

[bobleny]

Try:

htmlentities($wordad, ENT_QUOTES);

 

The simple htmlentities($wordad) should have worked though...

 

Here, this mat hep you:

http://us2.php.net/htmlentities

[dothedew101]

Well, I thought I had it with the htmlentities($wordad, ENT_QUOTES);

 

I have to keep psting and echoing this variable through about three pages. At the end, it is submitted to Authorize.net and comes back in email - along witht he rest of the variables. It echos just fine on my pages now, thanks to the htmlentities($wordad, ENT_QUOTES); code, but it still shows up as 20\\ in the email with everything after it gone. Guess I can't ask Authorize.net to use htmlentities($wordad, ENT_QUOTES); on their end.

 

I just think there must be a reason, maybe server side, why it does this. do other people have problems posting and echoing variables with double quotes? If I had control over it I'd just put it in single quotes, but this is a variable. The idiots of the world could put anything in there.

 

thanks for the help. I'm going to crawl under my desk and take a nap..... ;-(

[dothedew101]

Okay, thanks for the help, I think I have it. here is what worked for me:

 

<?php htmlspecialchars(stripslashes($wordad)); ?>

 

This posts or echos the textarea more or less as plain text. The email I get from Authorize.net will still have a slash behind all quote marks \" but I don't have any control over that. It at least gives me the whole textarea instead of dumping everything after the ". Hope this helps someone else.

 

PHP rocks!