[SOLVED] php stops echoing after apostrophe

[matthewst]

I have a script that writes (fwrite) a simple html page. In the script I have an input box:

<input name="rest_name" type="text" size="20" maxlength="100" value='<?php echo "$rest_name_old"; ?>' onfocus="clearDefault(this)"/>

the default value is pulled from a database

 

Users can type text into the box and hit submit, the content is then fwritten to anhtml page:

$rest_name = stripslashes($rest_name);
$stringData = "<h1>$rest_name</h1>\n";
fwrite($fh, $stringData);

p.s. I have tried it without the stripslashes and it's still broke

 

In my database and in the html page everything is fine. But when they go to edit the page later the default value of the text box is only echoed until the first apostrophe.

 

Example:

user enter mike's place in the text box and hits submit

the database is updated correctly and the html page echos "mike's place" as it should

later the user needs to change the data so they bring up the editing script

the text box default value should be "mike's place" but it only shows "mike"

[GingerRobot]

try using htmlentities:

 

<?php echo htmlentities($rest_name_old); ?>

 

The problem is that you are using single quotes to contain the value for the text box. Therefore when HTML finds the next single quote (the one in the string you are echoing) it thinks that is the termination of the value of the text box.

[chronister]

When dealing with database queries, you should always use mysql_real_escape_string(). When dealing with non-DB data you should still use add_slashes(). This will auto escape all single quotes which will break most scripts. Also keep in mind that you may need to use strip_slashes() to remove the slash for display.

 

Nate

[matthewst]

As it turns out I had two many quotes.

this:

value='<?php echo "$rest_name_old"; ?>'

to this:

value=<?php echo "$rest_name_old"; ?>

 

and I had to change from input type=text to

textarea

 

Thanks for the replies!!

I will be looking into htmlentities and mysql_real_escape_string() they sound like the proper way to be doing what i'm trying to do