single quote inside string

[ebolt007]

I have a form that people can fill out, and then it echos the string, however right now they can't use single quotes. Below is how I have it settup.

$side = '<p>About Me:</p>
<ul>
    <li>Birth Date: October, 23rd, 2010</li>
    <li>Hometown: Rapid City, SD</li>
    <li>Height: 4\'</li>
    <li>Weight: 50lbs</li>
    <li>Foot Size: 4</li>
    <li>Favorite Movie: All of the Shrek Movies!</li>
    <li>Favorite Book: Winnie the Pooh Series</li>
    <li>Favorite Cartoon Character: Eeyore or Donkey from Shrek!</li>
    <li>Favorite TV Show: Anything on Animal Planet!</li>
    <li>Favorite Food: Hay</li>
    <li>Favorite Pro Sports Team: Rapid City Rush</li>
    <li>Favorite Mascot:  Nugget, of course!</li>
    <li>Favorite Game: Donkey Kong!<br />
     </li>
</ul>';
      if ($side != NULL){
         echo "<div class=\"grid_6\" id=\"tertiary\">
         $side
      </div>";
      }else{
  
  }

 

And I would be able to use $side = "whatever I want to write"; because then they would still need to escape the double quotes with \" if they wanted to put in a link or anything. How do I do this with allowing them to just use single quotes when they enter their data so they don't have to \' (escape the single quote)?

 

Thanks

[laffin]

function addslashes

[ManiacDan]

Definitely not addslashes, that hasn't been recommended for years.

 

If you're trying to include content inside of HTML tags, you should use the htmlentities() function.

[laffin]

addslashes is more appropriate for the content. if you notice all the html tags?

 

[ManiacDan]

Indeed I did, which is why I suggested the html function.

[laffin]

Than why suggest html function, that would change all the <li> tags to <li> codes.

I seen it as Text that is to be displayed as html, not as text that is to be displayed as html code.

 

[ManiacDan]

It depends on the input and the way the users want the output to be.  I was assuming, based on the OP's post, that the users were inputting various strings which would be spit out INSIDE of HTML, rather than the users inputting HTML which would then be output and expected to be formatted.  If it's the latter, then no encoding at all is necessary.  I bet it's the former though, otherwise misplaced unescaped quotes wouldn't be a problem.