What is the best way to echo results from the database into html code in PHP ?

Question

when I have a value like this in the database ("foo")

how can I echo it without any conflict with html code

notice

<input type="text" value="<? echo '"foo"'; ?>" />

the result will be like this

<input type="text" value=""foo"" />

how can I fix it ?

Answer 1

<?php

echo "<input type='text' value='{$foo}' />" ;

?>

Answer 2

You can use htmlentities to overcome this problem like so:

<input type="text" value="<? echo htmlentities('"foo"'); ?>" />

this will return

<input type="text" value="&quot;foo&quot;" />

avoiding any conflict with html.

Answer 3

use urlencode or htmlspecialchars

<a href="<?php echo urlencode($dburl)?>" title="<?php echo htmlspecialchars($dbvalue)?>">link</a>

Answer 4

htmlspecialchars() basically, for example

<input type="text" value="<? echo htmlspecialchars($value, ENT_QUOTES); ?>" />

The ENT_QUOTES is optional and also encodes the single quote ' .

I used $value since I'm not sure what exactly you have in the database (with or without quotes?) but it will sit in some kind of variable if you want to use it anyway, so, I called that $value.

Since the above is a bit unwieldy I made a wrapper for it:

// htmlents($string)
function htmlents($string) {
  return htmlspecialchars($string, ENT_QUOTES);
}

So you can

<input type="text" value="<? echo htmlents($value); ?>" />

Not to be confused with the existing htmlentities(), which encodes all non-standard characters. htmlspecialchars() only encodes &, <, >, " and ', which is more appropriate for UTF8 pages (all your webpages are UTF8, right? ;-).