You always want to HTML-encode things inside HTML attributes, which you can do with htmlspecialchars: <span title=”<?php echo htmlspecialchars($variable); ?>”> You probably want to set the second parameter ($quote_style) to ENT_QUOTES. The only potential risk is that $variable may already be encoded, so you may want to set the last parameter ($double_encode) to false.
preg_quote() is what you are looking for: Description string preg_quote ( string $str [, string $delimiter = NULL ] ) preg_quote() takes str and puts a backslash in front of every character that is part of the regular expression syntax. This is useful if you have a run-time string that you need to match in … Read more
The MySQL documentation you cite actually says a little bit more than you mention. It also says, A “’” inside a string quoted with “’” may be written as “””. (Also, you linked to the MySQL 5.0 version of Table 8.1. Special Character Escape Sequences, and the current version is 5.6 — but the current … Read more
For some reason, the above answer didn’t work for me. For those like me who come after, here is what I found. I was expecting a single backslash to escape the bracket, however, you must use two if you have the pattern stored in a string. The first backslash escapes the second one into the … Read more
StringUtils.replaceEach(str, new String[]{“&”, “\””, “<“, “>”}, new String[]{“&”, “"”, “<”, “>”})
The correct way to escape double-quotes in VB is by doubling the double-quotes: <TestCase(“FirstNode”, “<node id=””FirstNode””>”)>
Yes, using " works: <input type=”text” name=”last_name” value=”"My quote!"” />
If it’s part of a Database query you should be able to use a Parameterized SQL Statement. As well as escaping your quotes, this will deal with all special characters and will protect you from SQL injection attacks.
You can either use: “texta’textb” (APOSTROPHE inside QUOTATION MARKs) or ‘texta’\”textb’ (APOSTROPHE text APOSTROPHE, then REVERSE SOLIDUS, APOSTROPHE, then APOSTROPHE more text APOSTROPHE) I used unicode character names. REVERSE SOLIDUS is more commonly known as backslash. In the latter case, you close your apostrophe, then shell-quote your apostrophe with a backslash, then open another apostrophe … Read more
This is what I use: var escapeShell = function(cmd) { return ‘”‘+cmd.replace(/([“‘$`\\])/g,’\\$1’)+'”‘; };