PHP - Escaping Single Quotes In Text...

I don't think I've asked this before have I??  can someone give me an internet KB that gives me all scenarios that warrant using singles or doubles?  as in, wrapping values, variables, and why I need to do either, and when, etc, etc....?

thanks

Edited March 29 by ajetrumpet

I've got a file with some strings that have both types of quotes in them.  And I seem to have managed to get the data, display it in my html, store it in a js array (using a json_encode in php and then simply inserting it into my js) but I cannot seem to pass the string as a parameter form an onclick function call to js.    For most strings the addslashes makes it work in the function call.  But for those with both sets of quotes it won't work.  My console tells me there are "unterminated string constants..".  I've experimented with many silly changes but none make it work.   Ex. of the strings:   What do you mean "It's crooked"?   Of course I could remove the contraction and that would probably work, but that would be a hack, would not it?

Greetings,

I'm trying to execute a shell command with a user-supplied password as input.  The password may contain apostrophes and and virtually any other character.  Unfortunately, when using escapeshellarg(), the password argument is interpreted as two separate arguments, as escapeshellarg() will handle apostrophes (single quotes) by breaking out of the already quoted text and using a backslash escape.


$password = escapeshellarg("ex'ample!%");  // The password will actually be supplied by an HTML form.

$command = ('echo '.$password);

echo "$command";

// Returns 'ex'\''ample!%'


Does anyone have any input on how to accomplish what I'm trying to do?  I'd like to allow obscure passwords without disallowing specific characters, while still being "safe" in passing the information to a shell command.  Double quotes would work for passing single quotes, but I'm afraid I might break other characters there.

Thanks.

I have a simple form that connects to this php page. Only two variables, "ArticleDescription" & "URL". I've tried a number of things, several of which are listed below, but have had no success. I'm certain it's just my idiocy but am requesting some help with this. I KNOW it's an easy fix, it's just over my head, I'm only four days into programming, so I'm a complete newb. Your kindness is requested.

----
<?php

// connection

mysql_select_db("doofyd5_comments", $con);

$ArticleDescription=mb_convert_encoding($ArticleDescription, 'UTF-8', 'UTF-8');
$URL=htmlspecialchars($URL, ENT_QUOTES);
$ArticleDescription=str_replace('\"','&quot;',$ArticleDescription);

$sql="INSERT INTO web_articles (ArticleDescription, URL) VALUES ('$_POST[ArticleDescription]','$_POST[URL]')";

if (mysql_query($sql,$con)) {
    header ("location:desiredurl");
    require_once('desiredurl");
    exit();
    }
    else {

echo "You may have added a single quote to the article description!";
}

mysql_close($con)

?>
----

for print html : What's Better, Faster and Optimized ?!?

Code: [Select]
echo "<tr height=\"22\">
    <form action = \"{$URL}/admin/edit.php\" method=\"POST\">
      <input type=\"hidden\" name=\"login\">
      <td width=\"15%\" bgcolor=\"$bgcolor\">&nbsp;<input type = \"text\" name = \"login\" value=" . $f['login'] . "></td>
      <td width=\"15%\" bgcolor=\"$bgcolor\">&nbsp; <input type = \"password\" name = \"password\" value=" . $f['pass'] . "> </td>
    </form>
        </tr>";

With PHP Method 2 : ( single )

Code: [Select]
echo ' <tr><form action = "' . URL . '/admin/editadmins.php" method="POST"> ';
 echo ' <td align="left" valign="top"><input type = "text" name = "login" value = "' . $f['login'] . '"></td>';
 echo ' <td align="left" valign="top"><input type = "password" name = "password" value = "' . $f['pass'] . '"></td></form></tr>';

Method 3 : (With Html And Php echo )

Code: [Select]
<tr height="22">
<form action = "../admin/editadmins.php" method="POST">
<td align="left" valign="top"><input type = "text" name = "login" value = "<?PHP echo $f['login']; ?>"></td>
<td align="left" valign="top"><input type = "text" name = "password" value = "<?PHP echo $f['pass']; ?>"></td>
</form>
<tr>
Thanks.

I'm using the codeigniter mvc framework and there's an escape function to use before adding the data to the database. This function adds single quotes around the string of data. Is there any already existing php function or does anyone know how to code a function that strips ONLY the surrounding single quotes?

Is there a difference between a single quote regex and and double quote regex ?   for example :

<?php
$res1 = preg_match('/shi*t/', $comment);
$res2 = preg_match("/shi*t/", $comment);
?>

Thank you
Edited by Dareros, 17 September 2014 - 07:07 PM.

I'm not sure if this is an HTML or browser issue...
But single quotes in strings from database don't work for me in Chrome for some reason. To mine or any other computers.
Every other browser detects these quotes.

I'm outputting an SQL result containing strings like:

Texas Hold'em
or
America's Cup

and I get

Texas Hold
America

how do i handle single quotes in sql query

Code: [Select]
" SELECT name from phrase WHERE name='$stitle' ";this returns an error because the name contains single quotes like this:
Johnson's.

When I add a ' or " quotes in a textarea I get a sql error when it tries to insert the record.    I was told to use mysqli_real_escape_string but that didn't work.    Here's my code -

   $blog= mysqli_real_escape_string($con, $_POST['blog']);
   

        $blog= $_POST['message'];
            
        $sql = "SELECT * FROM table WHERE `message` = '{$message}'";
        
        $result = mysql_query($sql);
        
        if ( mysql_num_rows ( $result ) > 0 )
        {
                        
            $error = "Message Exists.";
        }
        
        else
        {
        
         $error = "This message does not exist. Insert it!!!";
        
         $sql="INSERT INTO table (message) VALUES ('$_POST[message])";
        
        
        }
        
        if (!mysqli_query($con,$sql))
         {
         die('Error: ' . mysqli_error($con));
         }
        
        mysqli_close($con)

Edited by barkly, 26 October 2014 - 09:31 PM.

I have a navigation list displaying which is a mix of html and php, everything is working fine however now I want to convert this block of code into a function but am having major problems with quotes.

The line of code I currently have is 

$data = $db->query("SELECT * FROM menu")->fetchAll(PDO::FETCH_ASSOC);

foreach ($data as $row) { ?>
     <li><a href="<?php echo $row['url']; ?>" title="<?php echo $row['title']; ?>"><?php echo $row['icon'] . ' ' . $row['header']; ?></a></li>

<?php
	}
?>

As I say everything works using the above but now I am trying to echo the full li out and am having major issues with single and double quotes.

I currently have 

echo "<li><a href='#' title='the title'><i class='fas fa-user site-nav--icon'></i> Help</a></li>";

Now I am trying to use the $row['url'], $row['title'], $row['icon'] & $row['header'] as per the top example but I cannot get the combination of quote marks correct, whether to use double, single or a combination.

I would be grateful if someone could suggest the correct syntax for the a tag then I can work through the rest.

Thanks

Aloha,

I am using a simple html form and php script to send data to a SMS gateway that I have setup already. Everything works great. I fill out the form, the data is sent and instantly I get a text message on my iphone. Here's the problem. If I use an apostrophe in the message text field I get an error code. I am assuming the html text field needed to be escaped but I tried everything and I still get the error. Any ideas on what to check or do?

Here's the php send code (variables coming in from html form fields):


Code: [Select]
<?php



if (!empty($_POST)) {
   
    $name = trim($_POST["name"]);
   
 $contactnumber = trim($_POST["contactnumber"]);

    $message = trim($_message);


    if (empty($name)) {

        exit("Name cannot be blank.");

    }
   
   if (empty($contactnumber)) {

        exit("Please provide a contact number.");

    }
       
      
   if (empty($message)) {

        exit("Message cannot be blank.");

    }

   $subject = "$name . $contactnumber";


    $strlen_subject = ($subject != "") ? strlen($subject) + 3 : 0;

    $strlen_message = strlen($message);


    $express = $_POST["express"];

    if ($express && ($strlen_subject + $strlen_message > 160)) {

        exit("In case of express delivery, message length should not exceed 160 characters.");

    }

    elseif ($strlen_subject + $strlen_message > 130) {

        exit("In case of standard delivery, message length should not exceed 130 characters.");

    }
      

    $subject = urlencode($subject);
   
   $contactnumber = urlencode($contactnumber);

   $message = urlencode($message);
   

$ch=curl_init('https://app.eztexting.com/api/sending');

curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);

curl_setopt($ch,CURLOPT_POST,1);
   

curl_setopt($ch,CURLOPT_POSTFIELDS,"user=PuaDog&pass=808cougar&phonenumber=18087211458&subject=$subject&message=$message&express=1");

curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);

$data = curl_exec($ch);


    switch($data) {

        case 1:

         header('location:message_sent.php?message1=1');

            break;

        case -1:

            print("Invalid user or password");

            break;

        case -2:

            print("Credit Limit Reached");

            break;

        case -5:

            print("Local Opt Out");

            break;

        case -7:

            print("Invalid Message");

            break;

        case -104:

            print("Globally Opted Out Phone Number");

            break;

        case -106:

            print("Incorrectly Formatted Phone Number");

            break;

        case -10:

            print("Unknown Error");

            break;

    }

}




?>

Mahalo!
Tom

MOD Edit: [code] . . . [/code] tags added . . .

Quotation marks are confusing me.   What do you guys use when it comes to quotation marks?   In HTML attributes and throughout the bodies of my web pages, I use the HTML entity (&quot;). For example:

<a href="" title="Read &quot;Article Name&quot;">

<p>In his new book, he says: &quot;This is a quote.&quot;</p>

I thought that this is the best practice.   However, today, I read that it's perfectly safe to use straight quotes (") in the body, and that I should use the HTML entity only in HTML attributes.   Is that correct?   But what if I want to use curly quotes in the body instead of straight quotes? Should I always use the HTML entities for curly quotes (&ldquo; and &rdquo;), or can I also safely use the characters (“”)?   I heard that straight quotes are safe in all browsers, even if you don't specify the character set of your web pages, but that curly quotes are only safe if you specify the character set or if you use the HTML entities.   Is that true?   And what about the <q> tag? Apparently, it's compatible with all browsers but they treat it differently.
Edited by Fluoresce, 30 August 2014 - 07:37 AM.

The fancy-looking quotes won't insert into my DB, so I'm trying to convert them to %93 & %94 or normal quotes.    Nothing I've tried works.   Code:   $fancy=" “test” ";
$fixed=htmlentities($old, ENT_QUOTES);   echo "fancy: $fancy<br>"; echo "fixed: $fixed";

Results:

fancy: “test”
fixed:   I want $fixed to be %93test%94, or even "test" would work. 
Edited by rwmaho, 18 October 2014 - 01:28 PM.