Home/ Questions/Q 6367327
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-25T00:32:03+00:00

I have a form where users can enter any HTML. var title = Cool

  • 0

I have a form where users can enter any HTML.

var title = "Cool <a href="http://google.com">Check This</a>"

As you can see, the variable is having " but it can be also '. It causes an error if there is ". What is better way to fix this? Storing escaped string in database like below?

$title = str_replace('"', "'", $_REQUEST['title']); // Replace double quote with single quote as js variable above is wrapped with double quotes.

Or escape it before showing on page? Anything in jQuery like escape that can help here?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team
    var title="Cool <a href=\"http://google.com\">Check This</a>"

    Well, you cannot escape it using JavaScript because JavaScript needs to see what you want to escape and you want to escape that. If you use PHP, you can use addslashes() prior to inserting into JavaScript.

    Anyways, you should be careful of allowing to insert any HTML. Wrongly escaped HTML (like allowing to insert <script>) can allow to do various dangerous stuff, like stealing all cookies.

    • 0