Escape double quotes with variable inside HTML echo [duplicate]

Question

For a variable inside a echo that contains HTML, where would I add slashes to escape the double quotes?

Example:

echo "<input type=\"hidden\" name=\"id\" value=".$row['id']." />";

This part:

value=".$row['id']."

Sweettalk

With htmlspecialchars – Chartism

Answer 1

Some tips on outputting HTML with PHP:

1. Use single quotes so that you don't have to escape the double quotes (when using echo),
2. Use htmlspecialchars() to properly escape any "rogue" values you may have.

Example using echo:

echo '<input type="hidden" name="id" value="', htmlspecialchars($row['id'], ENT_QUOTES, 'UTF-8'), '" />';

Or printf():

printf('<input type="hidden" name="id" value="%s" />', 
    htmlspecialchars($row['id'], ENT_QUOTES, 'UTF-8')
);

Or, in HTML mode:

?>
<input type="hidden" name="id" value="<?php echo htmlspecialchars($row['id'], ENT_QUOTES, 'UTF-8'); ?>" />
<?php

Thiazole

FYI, the defaults for htmlspecialchars should suffice for a double-quoted value attribute so you can safely leave off the second and third arguments. – Memo

@Memo The defaults should suffice, but they historically didn't :) – Metaphysical

Biggest problem with PHP is its history :) – Memo

the defaults for htmlspecialchars should suffice for a double-quoted value Nope, at least for me I need a ENT_QUOTES for htmlspecialchars to work – Bahaism

Answer 2

Use htmlentities:

echo "<input type=\"hidden\" name=\"id\" value=\"".htmlentities($row['id'])."\" />";

Behoove

this doesn't seem to answer to the OP. (where the question seems to be how to escape the html attribute value) – Quean

Fair point - I misread the question originally. Edited. – Behoove

Answer 3

How about use single quotes so you don't have to escape any quotes. Like so:

echo '<input type="hidden" name="id" value="'.$row['id'].'" />';

Hyperpituitarism