Question

I query my mySql database table and retrieve text strings that look like this:

  This is a piece of a bronze artifact from the 'Bronze Age' -- it's in outstanding shape.
  His amusing comment on the 3rd-century clay bowl:  "Wow, she's a real piece!"
  It's no secret that you 'don't mishandle old parchment artifacts, they're "very" fragile' -- yet it still happens.

THE PROBLEM — I use php variables to hold the above strings read from the database, and use the PHP variables in my heredoc form. And I saw right away that a string got truncated when the first space in the string was encountered — the form only showed text up to the first space.

So I put single quotes around my PHP variables in the heredoc form (see below).

Now I get truncation when the string that came from the database has single quotes.

I can put quotes around my php variables but I’m getting truncations of the text strings when single quotes, double quotes
and if I don’t quote the PHP variable in the heredoc — a space in the string truncates the string from that point on.

I’m using PHP and here is the code that gets data from the mySql query result, stores the database data into PHP variables, then uses them in a heredoc:

   $row = mysql_fetch_row($result);
   //var_dump($row);  // the dump proves that the full string comes 
                      // out of the database, with spaces, single and double quotes

   $descriptionOfArtifact = $row[0];
   $commentsAboutTheDiggingSite = $row[1];
   $expertRecommendationsForRestoring = $row[2];

     // output the next row from the Artifacts table...
       echo <<< NEXT_ROW_HEREDOC
         <input type="text" id="Description"   
             name="descrip" value='$descriptionOfArtifact' readonly="readonly"></input>     
         <input type="text" id="Comments"       
             name="comments" value='$commentsAboutTheDiggingSite' readonly="readonly"></input>    
         <input type="text" id="Experts"
              name="experts" value='$expertRecommendationsForRestoring' readonly="readonly"></input>    
   NEXT_ROW_HEREDOC;

I need this form to display the full text string that is read from the database and stored in the above PHP variables. I thought the single quotes around the variable names would do it but I think the heredoc is messing that up (somehow).

So in a heredoc, how can I use PHP variables and be able to see:

• single quotes
• double quotes
• spaces
• html tags
• any printable character, really

in a heredoc form?

Answer 1

You have a space between the <<< and the end-of-text keyword. That’s probably causing the issue.

Also, call htmlspecialchars on $row[0], $row[1] and $row[2] when you’re assigning them to variables, and use double-quotes on your value="..." attribute.