Question

Possible Duplicate:
How can I properly escape HTML form input default values in PHP?

If I use a preset HTML input, for example:

$lmao=$_POST['lmao'];

echo <<<EOD
<input value="{$lmao}" name="lmao" type="text">
EOD;

If a " character gets into the variable, it will result in poo, and also a data loss on re-submission.

I could, of course:

preg_replace('/"/', '', $lmao);

But what if I wanted to keep that quote?

Answer 1

All user-inputted data that is being output within HTML attributes should be run through htmlspecialchars. This encodes quotes and other characters:

echo '<input value="'.htmlspecialchars($lmao).'" name="lmao" type="text">';