将 HTML 标记回显到 php 输入值中
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/18107455/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
echo HTML tag into php input value
提问by Aldy syahdeini
I have problem , I want to echo the string which is html tag, so I don't know how to say that but this is my code
我有问题，我想回显作为 html 标签的字符串，所以我不知道怎么说，但这是我的代码
echo '<input type="hidden" name="id" value='.($row['id']).'>';
where the value of $row['id'] is '<b>test</b>', the problem is on the output of the echo, the closing tag of <b>will close the input tag, so the value of input just '<b'thanks.
$row['id'] 的值在哪里'<b>test</b>'，问题出在 echo 的输出上，结束标签 of<b>将关闭输入标签，所以输入的值只是'<b'感谢。
回答by Flash Thunder
htmlentities($row['id'],ENT_QUOTES)this will encode <>to <and >
htmlentities($row['id'],ENT_QUOTES)这将编码<>为<和>
$str = "A 'quote' is <b>bold</b>";
echo htmlentities($str);
// Outputs: A 'quote' is <b>bold</b>
echo htmlentities($str, ENT_QUOTES);
// Outputs: A 'quote' is <b>bold</b>
Both above are correct, second one safer.
上面两个都对，第二个更安全。
回答by Quentin
- Pass data through
htmlspecialcharsto make it safe for inserting into HTML attributes (by converting characters with special meaning to entities). - Quote attribute values (your code doesn't have
"around the outputted row id) so that spaces,=and so on will be treated as part of the value
- 传递数据
htmlspecialchars以使其安全地插入 HTML 属性（通过将具有特殊含义的字符转换为实体）。 - 引用属性值（您的代码
"在输出的行 id 周围没有），以便空格=等将被视为值的一部分
Such:
这样的：
echo '<input type="hidden" name="id" value="'. htmlspecialchars($row['id']) . '">';
Or, better yet, don't output chunks of markup in PHP mode, switch to straight output mode until you need a variable / function call:
或者，更好的是，不要在 PHP 模式下输出标记块，切换到直接输出模式，直到需要变量/函数调用：
<input type="hidden" name="id" value="<?php echo htmlspecialchars($row['id']); ?>">
回答by John Dorean
Use htmlspecialcharswithin your echo statement, like so:
使用htmlspecialchars您的回音语句中，就像这样：
echo '<input type="hidden" name="id" value="' . htmlspecialchars($row['id']) . '">';
Also added quote marks for the value of value.
还为 的值添加了引号value。
回答by crowebird
You just need to properly escape:
你只需要正确地逃脱：
echo '<input type="hidden" name="id" value="'.($row['id']).'">';
回答by Suhail Mansoori
You will get what you want :-
你会得到你想要的：-
htmlentities($this->input->post('txtEditor'));
htmlentities($this->input->post('txtEditor'));
