Question

I have inserted the following TEXT value into mysql..

$_POST['groupname'] = "Linda's Group";
$groupname = $addslashes($_POST['groupname'];

then retrieve it like this..

$groupname = $row['groupname'];

when I echo it it shows up correctly as “Linda’s group”

but when I put it into..

echo "<input name='groupname' type='hidden' value='$groupname' />";

it shows up as “Linda”, only show text before the apostrophe

What am I doing wrong?

Answer 1

Whenever you want to send a string to the browser, use htmlspecialchars($string).

Replace that with:

echo "<input name='groupname' type='hidden' value='" . htmlspecialchars($groupname, ENT_QUOTES) . "' />";

… and remove the addslashes() call.

Also, make sure you always use mysql_real_escape_string($string) when inserting string values in a MySQL database.