Search code examples
phppostecho

Quotes in a posted variable is not displaying with echo on the next page

I have a hidden field <input type="hidden" name="thischeckout" id="thischeckout" value="<?php echo $htmlTable;?>"> in a form that is submitted.

When I use <?php echo $_POST["thischeckout"];?> on the next page, only a portion of the content is being displayed. I suspect quotes in $htmlTable are messing with the output.

Can I replace quotes with something that won't mess up when I output the POST via the php echo?

Solution

  • When you escape the output using htmlspecialchars, you have to tell the function the context for the escape. In this case, passing ENT_QUOTES is sufficient since that's really the only character that needs to be specially handled in a general HTML attribute.

    <input type="hidden" name="thischeckout" id="thischeckout" value="<?php echo htmlspecialchars($htmlTable, ENT_QUOTES);?>">