为什么我的htmlspecialchars和str_replace不工作？

Question

For my example, please visit http://jflaugher.mystudentsite.net/cmweb241/cmweb241_lab2.html

I am just needing the htmlspecialchars to work and the str_replace function to remove double and single quotes. Why isn't this working for me? I am very new to PHP :/

 <?php
  $username = str_replace(array("'", "\""), "", htmlspecialchars($_POST['username']));
  $password = str_replace(array("'", "\""), "", htmlspecialchars($_POST['password']));
  $comment = str_replace(array("'", "\""), "", htmlspecialchars($_POST['comment']));

  echo " <p>Your Username is: $username . </p>";
  echo " <p>Your Password is: $password . </p>";
  echo " <p>Your Comment was: $comment . </p>";

?>

Answer 1

按照Alex Lunix指定的相反顺序使用它

$username = htmlspecialchars(str_replace(array("'", "\""), "", $_POST['username']));

Answer 2

The previous answer is correct.

You apply first htmlspecialchars function. It converts every double quote to " and every single quote to '. These special characters are shown in a web browser as double and single quotes respectively.

You should apply first str_replace. The code below is correct:

<?php
foreach(array('comment', 'password', 'username') as $key) {
    $$key = empty($_POST[$key]) ? null : htmlspecialchars(str_replace(array("'", '"'), '', $_POST[$key]));
    echo " <p>Your " . $key. " is: " . $$key . "</p>";
}
?>