Quoting and escaping text strings advice

Question

I am mainly C++ programmer who returns to PHP seasonly. Every time I return I spend time to get used to echo/print correct JavaScript/HTML/CSS regarding the single quote and double quote ...etc. I need an advice in the form of a set of rules to follow for good escaping practice.

Edit This is a small example for my bad working code that I need to follow a rule to get more readable :

$ret = "<a href=\"$url\"><img src=\"images/delete.png\" width=\"20\" height=\"20\"></img></a>";

Thanks

Answer 1

The PHP documentation for Strings goes over the different ways string literals can be specified:

• single quoted
• double quoted
• heredoc syntax
• nowdoc syntax (since PHP 5.3.0)

Is this good enough?

Answer 2

I'd rather use the single quote syntax for working with HTML. Reasons:

1. it's faster ( noticable with larger strings with a bigger number of iterations )
2. it's easier to know where the vars are
3. html attributes need to be escaped using htmlspecialchars()
4. you don't have to escape every doublequote

So that string would look like:

$ret = '<a href="'.htmlspecialchars($url).'"><img src="images/delete.png" width="20" height="20"></img></a>';