html安全输入值

Question

I am trying to place a string into a hidden html input field in the following way.

$str = "HBO's hit series a game of thrones...'";

echo "<input type='hidden' value='$str' />";

The problem is that this will return something like...

<input type="hidden" value="HBO" s hit series a game of thrones.../>

I don't want to use urlencode() or mysql_escape_string as they aren't the appropriate functions to use, what is the correct function to use for something like this?

Answer 1

A quick solution would be changing the single quotes to double quotes

echo '<input type="hidden" value="$str" />';