In form
<input type="text" name="firstname" value="<?php echo $_POST['firstname']; ?>" />You may find if $_POST['firstname']=O'test may not work.We need to use htmlspecialchars or htmlentities()But we need to use
ENT_QUOTES to esacpe single, i.e.htmlspecialchars(
$_POST['firstname'],ENT_QUOTES) More about
htmlspecialchars:- '&' (ampersand) becomes '&'
-
'"' (double quote) becomes '"' when
ENT_NOQUOTESis not set. -
"'" (single quote) becomes ''' (or ')
only when
ENT_QUOTESis set. - '<' (less than) becomes '<'
- '>' (greater than) becomes '>'
No comments:
Post a Comment