Posted by Shawn Wilson on 09/19/05 16:34

"Steve" <googlespam@nastysoft.com> wrote in message
news:1127128143.582679.46850@g43g2000cwa.googlegroups.com...
>
>> >>My problem is with the use of an apostrophe (single quote) and other
>> >>such
>> >>characters as they break my HTML. I'm also using javascript and it's a
>> >>problem there as well.
>
> Text in javascript strings that could have apostrophes must be escaped.
> The javascript escape character is a backslash. To do this see the user
> notes under <http://www.php.net/addslashes> - search that entry for
> "javascript".

Yeah, that's what I ended up doing is slashing it with addslashes()...
although that created it's own little bump since I use that same php
variable for the image's alt tag and HTML leaves the slash there so I got
"Ginny\'s Wedding" as the image alt tooltip. Had to add another variable
(one slashed and one not) to get it right.

The thing with extended ASCII encoding is that it still broke my JS. I
don't know which character it didn't like, the ampersand or the semicolon
maybe, but either way it also broke the script. The escaping is what I had
to go with.

Would anyone suggest escaping things before I put them into SQL in the first
place? Currently the method I use to insert into SQL has no problem with
not escaping them... probably because it's escaping them by itself during
insert
only the resulting SQL does not have slashes in it.

Is it just a general good practice to write [Ginny\'s Wedding] to the DB
instead of [Ginny's Wedding] ? Or does it not matter as long as I make it
work for me either way?

--
Shawn Wilson

[Back to original message]