0

I'm inserting the following TEXT value into MySQL using..

$groupname = addslashes($_POST['groupname'];

When getting the value from Mysql I'm using

$name = $row['groupname'];

echo $name;

And this show correctly as "Mr. Davis's Group"

but when this value in added to a form as

then I pass the value to another page, and retrieve it as

$name = $_POST['groupname']; echo $name;

it show up as "Mr. Davis" keeping everything before the apostrophy.

??No clue why, i've tried adding stripslashes($_POST['groupname']; and same thing happens

DobotJr
  • 3,929
  • 9
  • 36
  • 49

2 Answers2

3
<input name='groupname' type='hidden' value='$groupname' />

Will generate:

<input name='groupname' type='hidden' value='Mr Davis's Group' />
                                                     ^----

At the indicated spot, the browser's parser will see the 'end' of the value=, followed by some unknown attribute s and a broken attribute Group '.

To embed this type of text in a form, you need to use htmlspecialchars(), which will convert any HTML metacharacters (<, >, ', ") into their character entity equivalents, so they can be safely embedded in a form.

addslashes() is a deprecated method of "safely" adding something into a database. It will not make something safe to embed in HTML.

Marc B
  • 356,200
  • 43
  • 426
  • 500
  • Ah, your powers of observation are great. +1 – Jonah May 24 '11 at 17:28
  • where exactly would I use htmlspecialchars, before putting into the DB or after? – DobotJr May 24 '11 at 17:54
  • when retrieving the data. Never store the html-encoded data in the database, as you never know what you'll need the data for afterwards. If it's going into a spreadsheet, then the HTML encoding would be useless and you'd just have to undo it. – Marc B May 24 '11 at 17:59
  • 1
    I know this is old, but for completeness: In this case, you will probably need to use the flag `ENT_QUOTES`: `htmlspecialchars($groupname, ENT_QUOTES)`. – Stefan Feb 10 '17 at 12:47
1

Check the text encoding of your input webpage. Match your db charset - use utf-8.

sophocles
  • 11
  • 1