smarty not display text with double quotes

Question

I am using smarty for template. I am fetching one issue with rendering. i have one variable value of that variable is

this is text" data

but when i print this value in tpl file it prints only this is text except the

this  is text" data

Why this is happening? please help Thanks in advance

you should escape when you put it to db. For example via htmlspecialchars() or addslashes(). Then unescape(when you use addslashes) when you print it. Quotes can be changed to " which is valid against html standard, this replacing can be obtained via htmlspecialchars(); — Robert, May 09 '13 at 11:31
DB: mysqli/pdo prepare() or mysql mysql_real_escape_string() not addslashes or htmlspecialchars, and OUTPUT: htmlspecialchars() as htmlentities() may cause problems with UTF-8 — Waygood, May 09 '13 at 11:33

score 3 · Accepted Answer · answered May 09 '13 at 16:03

3

In smarty you can escape the data using {$variable|escape:'format'}

In this case a format of html should do the trick

{$variable|escape:html}

answered May 09 '13 at 16:03

Waygood

Steven Moseley · Answer 2 · 2013-05-09T11:43:43.020

2

You shouldn't be using quotes in HTML text-nodes anyway (it's invalid). Use " (escaped) instead.

So for your example:

this is text&quot; data

If your text is coming from your DB, use htmlspecialchars() to properly escape it:

$val = htmlspecialchars($val);

edited May 09 '13 at 11:43

answered May 09 '13 at 11:18

Steven Moseley

this value is coming from db. – Praveen kalal May 09 '13 at 11:18
escape it on the way out with `htmlentities()` – Steven Moseley May 09 '13 at 11:19
1

I suggest `htmlspecialchars()` not `htmlentities()` http://php.net/manual/en/function.htmlspecialchars.php http://stackoverflow.com/questions/46483/htmlentities-vs-htmlspecialchars – Waygood May 09 '13 at 11:30
+1 my problem is solved but any alternate solution in smarty itself. – Praveen kalal May 09 '13 at 11:37
2

smarty: {$test|escape:html} should do it http://www.smarty.net/docsv2/en/language.modifier.escape.tpl – Waygood May 09 '13 at 11:46
@Waygood Add that as an answer; while `htmlspecialchars` will work, it is much more appropriate to do the escaping in the template engine if one is being used. – IMSoP May 09 '13 at 14:11

2 Answers2