PHP: Can't escape characters in for inputs - php

Question

I'm new to this PHP thing. Trying to escape some php script in a form and can't figure out how to do it.
I've tried all different combinations of \' and \" but I'm stuck. Please the relevant portion of script and advise what I'm doing wrong.
This is the example of input:
<label for="fullName">Full Name : </label>
<input type="text" name="fullName" id="fullName" value=\' "<?php echo $C_fullName ?>" \' />
And this is the rest of the display/redisplay part of the script so you can see it in context...
//Redisplay/Display form
$self = htmlentities($_SERVER['PHP_SELF']);
$displayOutput .= '
<form action="' . $self . '" method="post">
<fieldset>
<div>
<label for="fullName">Full Name : </label>
<input type="text" name="fullName" id="fullName" value=\' "<?php echo $C_fullName ?>" \' />
</div>
<div>
<label for="email"> Email :</label>
<input type="email" name="email" id="email" />
</div>
<div>
<label for="mailFormat">Mail Format</label>
<select name="mailFormat" id="mailFormat">
<option value="plain">Plain text</option>
<option value="html">HTML</option>
</select>
</div>
<div>
<input type="checkbox" name="terms" id="terms" value="yes" />
<label for="terms">Tick this box to confirm you have read our terms and conditions</label>
</div>
<div>
<input type="submit" name="submit" value="submit" />
</div>
</fieldset>
</form>';//close form

Answer 1

try to change this line of code
<input type="text" name="fullName" id="fullName" value=\' "<?php echo $C_fullName ?>" \' />
to
<input type="text" name="fullName" id="fullName" value="'.$C_fullName.'" />
and apply this change at other places

Answer 2

The problem is that you are trying to escape into PHP evaluation from within PHP. That doesn't make sense.
When a document is parsed, it is interpreted as normal, verbatim text until the interpreter hits an escape sequence like <?php. Everything until the closing ?> (or till the end of file) is interpreted as PHP. That's why putting another <?php opening sequence into your code is nonsensical.
The form markup in above code is build as a PHP string. What you are trying to do is to create a string and concatenate a variable into it. PHP offers multiple ways to do this. The simplest, in your case, is to use the concatenation operator .. Close the string, concatenate the variable, and concatenate the rest of the string.
… value="' . $C_fullName . '" …
It's no different than the action definition in the first line.
You might also want to look at the heredoc syntax, it can be quite useful for situations like yours.

Answer 3

You can give a try with the following code :
$displayOutput .= '
<form action="' . $self . '" method="post">
<fieldset>
<div>
<label for="fullName">Full Name : </label>
<input type="text" name="fullName" id="fullName" value='; echo $C_fullName; $displayOutput .=' />
</div>
<div>
<label for="email"> Email :</label>
<input type="email" name="email" id="email" />
</div>
<div>
<label for="mailFormat">Mail Format</label>
<select name="mailFormat" id="mailFormat">
<option value="plain">Plain text</option>
<option value="html">HTML</option>
</select>
</div>
<div>
<input type="checkbox" name="terms" id="terms" value="yes" />
<label for="terms">Tick this box to confirm you have read our terms and conditions</label>
</div>
<div>
<input type="submit" name="submit" value="submit" />
</div>
</fieldset>
</form>';