quotes in form value fields

[coo_t2]

Do you folks know any clever ways of getting quotes(and maybe other nasties that might break (x)html) into the value attribute of a form control, without breaking the (x)html?

example:
<input type="text" name="article_title" value="Simon says, "stop!"" />

Of couse I can't do this. I could encode the value string, but the encoded version would show in the form field, which wouldn't be good for non-techie types.

I know you can use single or double quotes for attributes, but I'd like to allow the possibility of letting both types of quotes in the value, and the string is coming from a DB, so I don't think that's a solution.

Btw, I'm actually inserting the value from PHP, but I don't think that matters.

Something just crossed my mind. I could decode the value in the field after the document loads with javascript. It would be nice if there was a way to do it without JS though.

--ed

[coo_t2]

I knew I was having a mental lapse, but sometimes being cognizant of that fact doesn't help any.

Solution: &quot;

--ed

[mattjacob]

PHP, eh? Excellent. I wrote this function to handle all my HTML entity conversions. It's mainly for people who copy-and-paste from Word documents (it converts curly quotes, ellipses, etc.), but you could use it like this:

<?php

function html_encode($string)
{
    // Converts a string containing special characters into the appropriate
    // HTML entities

    $trans_tbl = get_html_translation_table(HTML_ENTITIES, ENT_QUOTES);

    $trans_tbl[chr(133)] = '…';
    $trans_tbl[chr(145)] = '‘';
    $trans_tbl[chr(146)] = '’';
    $trans_tbl[chr(147)] = '“';
    $trans_tbl[chr(148)] = '”';
    $trans_tbl[chr(149)] = '•';
    $trans_tbl[chr(150)] = '–';
    $trans_tbl[chr(151)] = '—';
    $trans_tbl[chr(153)] = '™';
    
    return strtr($string, $trans_tbl);
}

?>
<input type="text" name="article_title" value="<?php echo html_encode('Simon says, "stop!"'); ?>" />