StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

PO
text
Body
copied!<p>How are you exactly testing it?</p> <pre><code><?php //sanitize data from db before displaying on webpage function htmlsan($htmlsanitize){ return $htmlsanitize = htmlspecialchars($htmlsanitize, ENT_QUOTES, 'UTF-8'); } var_dump(htmlsan('<>\'"')); </code></pre> <p>... prints:</p> <pre><code>string(20) "&lt;&gt;&#039;&quot;" </code></pre> <p>My guess is that your input string comes from Microsoft Word and contains typographical quotes:</p> <pre><code>var_dump(htmlsan('“foo”')); // string(9) "“foo”" </code></pre> <p>If you do need to convert them for whatever the reason, you need <code>htmlentities()</code> rather than <code>htmlspecialchars()</code>:</p> <pre><code>var_dump(htmlentities('“foo”', ENT_QUOTES, 'UTF-8')); // string(17) "&ldquo;foo&rdquo;" </code></pre> <h1>Update #1</h1> <p>Alright, it's time for some proper testing. Type a single quote (<code>'</code>) in your <code>comment</code> database field and run the following code when you retrieve it:</p> <pre><code>var_dump(bin2hex("'")); var_dump(htmlspecialchars("'", ENT_QUOTES, 'UTF-8')); var_dump(bin2hex($row['comment'])); var_dump(htmlspecialchars($row['comment'], ENT_QUOTES, 'UTF-8')); </code></pre> <p>It should print this:</p> <pre><code>string(2) "27" string(6) "&#039;" string(2) "27" string(6) "&#039;" </code></pre> <p>Please update your question and confirm whether you ran this test and got the same or a different output.</p> <h1>Update #2</h1> <p>Please look carefully at the output you claim to be obtaining:</p> <pre><code>string(6) "'" </code></pre> <p>That's <em>not</em> a string with 6 characters. You are not looking at the <strong>real</strong> output: you are looking at the output as <strong>rendered</strong> by a browser. I'm pretty sure you are getting the expected result, i.e. <code>string(6) "&#039;"</code>. If you render <code>&#039;</code> with a web browser it becomes <code>'</code>. Use the <em>View Source</em> menu in your browser to see the real output.</p>

Querying!

Guidance

An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload