PHP Escaping double Quote on echo with onclick

Question

Please notice the addslashes($model->subject) part in the code below. If the subject contains single quote, it works fine but if it has double quote, javascript generates error and treats that the onclick method ends on the double quote character. How to solve that error?

    $string.=" <a href='#' class='' data-toggle='modal' "
    . "onclick=\"to_edit('" . $model->id . "','" . $model->doc_type_level_1 . "','" . $model->doc_type_level_2 . "','" . $model->doc_type_level_3 . "','" . addslashes($model->subject) . "','" . $model->date . "',"
    . "'" . $model->date_release . "','" . $model->is_confidential . "'"
    . ")\" "
    . "data-target='#modal_doc' ><span class='fa fa-pencil'></span></a>";

Answer 1

您应该使用htmlspecialchars转换这些实体，并使用以下代码：

htmlspecialchars($model->subject, ENT_QUOTES);