Question

Possible Duplicate:
PHP: Convert special characters to HTML character codes

I have a string column in DB which can have special character “&”.

This column value is used in options like:

<select onChange="display()">
echo "<option value='".$products."' </option>";

Added:
After this the HTML that is generated is correct:

<option value="{"varId":"2 & 4 wheel","month":"June"}"> two and four wheel </option>

And it is sent to PHP script. If the value of $products is “2 & 4 wheel” then in PHP all that I am getting is “2 ” and my query is failing.

I know this is because HTML can not handle special characters but how to get around this problem.

Answer 1

HTML can handle “special characters”. Every language has its own “special characters”, and every language has its own rules for how to deal with them. HTML has HTML entities for this purpose. Before echoing any arbitrary values into HTML, always HTML-entity-encode them using htmlspecialchars.

For more in-depth information about the topic, see The Great Escapism (Or: What You Need To Know To Work With Text Within Text).

---

Regarding your update:

<option value="{"varId":"2 & 4 wheel","month":"June"}"> two and four wheel </option>

That is in no way correct HTML. The value contains ", and it’s entirely ambiguous which " are surrounding the value="..." attribute and which are part of the value. It needs to look like this:

<option value="{&quot;varId&quot;:&quot;2 &amp; 4 wheel&quot;,&quot;month&quot;:&quot;June&quot;}"> two and four wheel </option>

Just look at the difference in syntax highlighting here. And you’d get this with:

$value = '{"varId":"2 & 4 wheel","month":"June"}';
echo '<option value="' . htmlspecialchars($value); .'"> two and four wheel </option>';