php var value contains quotes - php

Question

So... I have a mysql_fetch_array and I'm running into an issue when some of the mysql data contains single or double quotes. This is the dumbed down version of my code:
while($row=mysql_fetch_array($list)) {
echo "<tr>";
echo "<td onclick='edit_form(\"" . $row['item'] . "\");'>" . $row['item'];
echo "</td></tr>";
}
The edit_form() function is used to send the value of the current item back to the value of the input in the form so the user can then easily edit their entry and then sends an UPDATE command to mysql along with the proper primary key id (which I left out because of irrelevancy). The only issue I have is if a user puts single or double quotes into the form then it messes up the onclick attribute. Please help!! I am pretty new to php and can't figure this out. I've messed around with htmlentites() and html_entity_decode() but am still getting no where. Thank you so much!

Answer 1

Use htmlspecialchars on $row['item'] before inserting it in your document.
So your "dumbed-down" code should be:
while($row=mysql_fetch_array($list)) {
$item = htmlspecialchars($row['item']);
echo "<tr>";
echo "<td onclick='edit_form(\"" . $item . "\");'>" . $item;
echo "</td></tr>";
}

Answer 2

Try the below line instead of the original in your code and see if it works:
echo "<td onclick='edit_form(\"" . str_replace('"',"&quote;",$row['item']) . "\");\">" . $row['item'];
And where you would like to display the $item field, just replace it in reverse if you get &quote; instead of ' " '. For example:
$qoute_free= str_replace('&quote','"',$passed_value);
If you are using it in javascript, the function can be as below:
function edit_form(passed_value)
{
new_value=passed_value.replace(/&quote;/g,'"');
}

Answer 3

I advise using json_encode. That way you don't have to worry about special cases htmlspecialchars might miss (such as newlines).
while($row=mysql_fetch_array($list)) {
echo "<tr>";
echo "<td onclick='edit_form(" . json_encode($row['item'], JSON_HEX_APOS) . ");'>" . $row['item'];
echo "</td></tr>";
}

Answer 4

I'm just putting the values back into my <form> (when they click on a <td>) and when they hit SUBMIT it directs the data to a different .php file that uses a MySQL UPDATE instead of an INSERT. I finally found some code that works!
$list is a mysql_query I ran at the top of the document
$item is the title of one of my columns in MySQL
while($row=mysql_fetch_array($list)){
$item = json_encode($row['item']);
$item = str_replace("'","'",$item);
echo "<td onclick='edit_form(" . $item . ");'>" . $row['item'] . "</td>";
}
Now it display's correctly in the <form> when <td> is clicked (by jQuery input.val($item)) and it shows up in the table correctly via $row['item']. I don't really understand exactly how it's working (how the encode is making it work) but I am glad it is. Crazyness!!!! Thanks for responding! and thanks for your effort!!