Escape double quotes with variable inside HTML echo

Question

For a variable inside a echo that contains HTML, where would I add slashes to escape the double quotes?

Example:

echo "<input type=\"hidden\" name=\"id\" value=".$row['id']." />";

This part:

value=".$row['id']."

score 64 · Accepted Answer · edited Jul 02 '18 at 13:47

64

Some tips on outputting HTML with PHP:

Use single quotes so that you don't have to escape the double quotes (when using echo),
Use htmlspecialchars() to properly escape any "rogue" values you may have.

Example using echo:

echo '<input type="hidden" name="id" value="', htmlspecialchars($row['id'], ENT_QUOTES, 'UTF-8'), '" />';

Or printf():

printf('<input type="hidden" name="id" value="%s" />', 
    htmlspecialchars($row['id'], ENT_QUOTES, 'UTF-8')
);

Or, in HTML mode:

?>
<input type="hidden" name="id" value="<?php echo htmlspecialchars($row['id'], ENT_QUOTES, 'UTF-8'); ?>" />
<?php

edited Jul 02 '18 at 13:47

John Kary

answered Dec 16 '13 at 22:59

Ja͢ck

2

FYI, the defaults for `htmlspecialchars` should suffice for a double-quoted `value` attribute so you can safely leave off the second and third arguments. – Phil Dec 16 '13 at 23:05
1

@Phil The defaults *should* suffice, but they historically didn't :) – Ja͢ck Dec 16 '13 at 23:05
Biggest problem with PHP is its *history* :) – Phil Dec 16 '13 at 23:06
`the defaults for htmlspecialchars should suffice for a double-quoted value` Nope, at least for me I need a `ENT_QUOTES` for `htmlspecialchars` to work – Ng Sek Long Aug 20 '19 at 02:10

elixenide · Answer 2 · 2013-12-16T23:10:34.183

4

Use htmlentities:

echo "<input type=\"hidden\" name=\"id\" value=\"".htmlentities($row['id'])."\" />";

edited Dec 16 '13 at 23:10

answered Dec 16 '13 at 22:58

elixenide

this doesn't seem to answer to the OP. (where the question seems to be how to escape the html attribute value) – nl-x Dec 16 '13 at 23:07
Fair point - I misread the question originally. Edited. – elixenide Dec 16 '13 at 23:11

score 0 · Answer 3 · answered Dec 16 '13 at 22:59

0

How about use single quotes so you don't have to escape any quotes. Like so:

echo '<input type="hidden" name="id" value="'.$row['id'].'" />';

answered Dec 16 '13 at 22:59

Bryan Elliott

3 Answers3