在数据库的html输入值中显示双引号

Question

This is my php code. For an example:

<?php
while($row=sqlsrv_fetch_array($result))
        {
            $ItmName = $row['ItemName'];
        }
?>

This is my html:

<input type="text" id="ItmName" name="ItmName" value="<?php echo $ItmName; ?>" />

If the data is as such 3" FILE which have double quotes, in the textbox field it will only be displayed as:

3

which it supposed to be

3" FILE

but IF the data is 3' FILE which is a single quote, it will be displayed as 3' FILE. So there's no problem. So my question is, how to display the data with the double quotes in a HTML input's value.

Answer 1

Always always always escape output that you don't trust.

Use htmlspecialchars (or htmlentities) to escape strings so they are safe to use in HTML.