echo HTML tag into php input value

Question

I have problem , I want to echo the string which is html tag, so I don't know how to say that but this is my code

echo '<input type="hidden" name="id" value='.($row['id']).'>';

where the value of $row['id'] is '<b>test</b>', the problem is on the output of the echo, the closing tag of <b> will close the input tag, so the value of input just '<b' thanks.

run it through htmlentities function.

MightyPork
– MightyPork

2013-08-07 15:28:27 +00:00
Commented Aug 7, 2013 at 15:28 — MightyPork
– MightyPork, Commented Aug 7, 2013 at 15:28
Your just missing a set of double quotes around the value..

ɴᴀᴛᴇ ᴅᴇᴠ
– ɴᴀᴛᴇ ᴅᴇᴠ

2013-08-07 15:30:17 +00:00
Commented Aug 7, 2013 at 15:30 — ɴᴀᴛᴇ ᴅᴇᴠ
– ɴᴀᴛᴇ ᴅᴇᴠ, Commented Aug 7, 2013 at 15:30

Flash Thunder · Accepted Answer · 2013-08-07 15:30:45Z

5

htmlentities($row['id'],ENT_QUOTES) this will encode < > to < and >

$str = "A 'quote' is <b>bold</b>";


echo htmlentities($str);
// Outputs: A 'quote' is &lt;b&gt;bold&lt;/b&gt;

echo htmlentities($str, ENT_QUOTES);
// Outputs: A &#039;quote&#039; is &lt;b&gt;bold&lt;/b&gt;

Both above are correct, second one safer.

answered Aug 7, 2013 at 15:30

Flash Thunder

12.1k10 gold badges55 silver badges103 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Quentin · Accepted Answer · 2013-08-07 15:28:21Z

4

Pass data through htmlspecialchars to make it safe for inserting into HTML attributes (by converting characters with special meaning to entities).
Quote attribute values (your code doesn't have " around the outputted row id) so that spaces, = and so on will be treated as part of the value

Such:

echo '<input type="hidden" name="id" value="'. htmlspecialchars($row['id']) . '">';

Or, better yet, don't output chunks of markup in PHP mode, switch to straight output mode until you need a variable / function call:

<input type="hidden" name="id" value="<?php echo htmlspecialchars($row['id']); ?>">

answered Aug 7, 2013 at 15:28

Quentin

949k136 gold badges1.3k silver badges1.4k bronze badges

Comments

John Dorean · Accepted Answer · 2013-08-07 15:44:22Z

3

Use htmlspecialchars within your echo statement, like so:

echo '<input type="hidden" name="id" value="' . htmlspecialchars($row['id']) . '">';

Also added quote marks for the value of value.

edited Aug 7, 2013 at 15:44

answered Aug 7, 2013 at 15:30

John Dorean

3,8949 gold badges53 silver badges84 bronze badges

3 Comments

Quentin Over a year ago

Use what? This is a game of spot-the-difference. Answers should explain what they are doing.

John Dorean Over a year ago

It's pretty obvious what had changed. Regardless, I've edited it to make it crystal clear.

Quentin Over a year ago

You have also added quote marks around the value attribute's value. Those aren't obvious. Quote marks are easy to miss.

crowebird · Accepted Answer · 2013-08-07 15:28:22Z

1

You just need to properly escape:

echo '<input type="hidden" name="id" value="'.($row['id']).'">';

answered Aug 7, 2013 at 15:28

crowebird

2,5961 gold badge19 silver badges20 bronze badges

1 Comment

Mash Over a year ago

I'd use " instead of \' since other attributes are in double quotes.

Suhail Mansoori · Accepted Answer · 2019-12-13 10:56:18Z

-1

You will get what you want :-

htmlentities($this->input->post('txtEditor'));

answered Dec 13, 2019 at 10:56

Suhail Mansoori

292 bronze badges

Collectives™ on Stack Overflow

echo HTML tag into php input value

5 Answers 5

Comments

Comments

3 Comments

1 Comment

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

5 Answers 5

Comments

Comments

3 Comments

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Related