转义HTML输出的引号？

Question

So magic_quotes doesn't exist anymore in php, but I need a function like that (or maybe I don't?)
Let me quickly explain what I want to do:

<table>
    <button onclick="location.href='/test?colA=<?php echo $var1; ?>&colB=<?php echo $var1; ?>'">click</button>
</table>

The Problem: $var1 and $var2 can contain singlequotes and doublequotes.

Here is what I tried, which did not work:

$var1 = str_replace('"','"',$var1);
$var1 = str_replace('\'',''',$var1);

$var2 = str_replace('"','"',$var2);
$var2 = str_replace('\'',''',$var2);

Answer 1

Applying urlencode on both vars would actually be sufficient. This escapes all special characters, including quotes.

Technically it's also in HTTP attribute context, so adding htmlspecialchars() would be professional.

Most correctly, though this is slightly overpedantic, you would first cover the URL parameter context, then the JavaScript string context, then HTML.

<table>
    <button onclick="location.href=<?= 
        htmlspecialchars(
            json_encode(
                "/test?" .
                http_build_query(
                    array("colA" => $var1, "colB" => $var2)
                )
            )
        )
    ?>">click</button>
</table>