Search code examples
attributescgiquoting

How to properly escape quotes inside form INPUT attribute assignments?


I have various things that need to end up in a CGI form, thus:

<INPUT TYPE="TEXT" SIZE=64 MAXLENGTH=64 NAME="name" VALUE="thing">

...my understanding (limited, but I'm learning) is that CGI inputs require double quotes as delimiters.

However, some of the things I need to put in there have double quotes. Some have single. Some have none. Some could easily have both. Basically, anything at all might end up in that field (because this is in a field generator, and the idea is to generate the content for those fields from whatever one might desire.)

Conceptually, I imagine:

<INPUT TYPE="TEXT" SIZE=64 MAXLENGTH=64 NAME="name" VALUE="a \"Quoted\" thing with backslash thusly: \\">

...but have no idea if that's right, or what.


Solution

  • Use HTML entities. " == &quot; and so on.

    so...

    <INPUT TYPE="TEXT" SIZE=64 MAXLENGTH=64 NAME="name" VALUE="a &quot;Quoted&quot; thing with backslash thusly: &#92;">
    

    ...does the trick.