单引号和双引号问题

Question

I was struggling with escaping double and single quotes with addslashes() and stripslashes()... in a mini web application that just inserts values and retrieves those values back out in a form to edit, and a general page to view the attributes. Finally I settled on this function to change single and double quotes:

function fixQuotes($string) {
    $string = str_replace("'", ''', $string);
    $string = str_replace('"', '"', $string);
    return $string;
}

Since I don't have any details for you as for what was happening before using this method, I can't really ask what was wrong. Rather, I would like to know if there are any drawbacks of using this function to replace single and double quotes with the html entities.

Answer 1

You can't just magically "fix" quotes without knowing where the data is going to.

1. When you insert data into a database, escape it with the database API's escape function. If you're using the legacy MySQL API (which you should not be in new code as it is deprecated), use mysql_real_escape_string . If you're using the MySQL-improved API, use mysqli_real_escape_string . If you're using PDO, use bindValue , or execute with the input_parameters parameter, or quote .

2. When you echo text to an HTML page, use htmlspecialchars .