Question

Let say i have a column product name and it has value Shoe's.
When i pick that value from db and use mysql_real_escape_string and placed it in html hidden input it becomes <input type='hidden' value='Shoe\'s' id='product_name'>

When i do $('#product_name').val() it return only Shoe\ truncating the s or rest of the value after that. The jQuery is assuming an escaped single quote as a closing quote for attr value.

On solution is to use value="" (enclosed in double quotes) but what if value contains a double quote? So the problem persists.
Any help is appreciated.

Thanks!

Answer 1

You must not use mysql_real_escape_string for HTML output. Use the appropriate htmlspecialchars instead.