Question

so I have a field you can type in. After you type you press ok, and it will send an ajax call to save.php and it inserts into the database (with php), and then output what you have type. And then ajax call on succes grabs the output and alerts it (success: function(msg){ alert(msg) }). the response is in html.

Works good until i use ' or " in the field. example if i write: 'asdadsasd" it turns out: \'asdadsasd\" How can I fix this?

Dont know if it matters, but in save.php I have:

header("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1
header("Expires: Sat, 26 Jul 1997 05:00:00 GMT"); // Date in the past
header('Content-type: text/html; charset=utf-8');

And it outputs the message like this:

echo htmlspecialchars(strip_tags($message), ENT_QUOTES, 'utf-8'); 

Answer 1

It’s because the ENT_QUOTES option, I let you check: http://php.net/manual/en/function.htmlentities.php

EDIT: I’ve forgotten slashes, have you magic_quotes activated?