Escape double quote in HTML?

[larkin]

Hello,

I'm having a double quote problem. I have an asp variable that contains a string with a double quote, like this:

dim strQ
strQ = "How did ""this"" happen?"

When I try to put it into an HTML textbox, like this:

<input type="text" id=txQ name=txQ value="<%= strQ %>">

the server code is processed and it comes out like this:
<input type="text" id=txQ name=txQ value="How did "this" happen?">

and it cuts off my string prematurely. Is there a way to escape the quote in html so that this doesn't happen?

I tried replacing the double quote with "&quot;", but I don't want to store "&quot;" in my database when my textbox info gets saved.

Any thoughts?:rolleyes:

[ShMiL]

don't store the &quote; in the DB.
store it as it is and use function which will replace problematic chars (like this quotes) with an HTML code (&quote;) when you want to put it in a form.

[ghell]

aka

<input type="text" id=txQ name=txQ value="<%=Response.HTMLEncode(strQ)%>">

[larkin]

Ok, I see the response.HTMLEncode when I put it in the form. When I read back from the form to save to my database, it will read "&quot;" and save that in the database instead of double quote, though. Won't it?

When I read the value from the form, do I have to do something to replace &quot; with " before I save it to my DB?

[ShMiL]

Ok, I see the response.HTMLEncode when I put it in the form. When I read back from the form to save to my database, it will read "&quot;" and save that in the database instead of double quote, though. Won't it?

When I read the value from the form, do I have to do something to replace &quot; with " before I save it to my DB?

It won't store &quote; to the DB, and you have to do nothing before storing.
But won't trying it be faster and smarter than waiting for an answer?

[ghell]

Its kind of hard to answer with the vague question. as far as i know the &quot; will make it appear in the textbox like this [hello there this is a " test] and when you submit it it will appear as that but i could be wrong, i used to have a html editor using a textarea which needed & to be changed to &amp; and then < to be changed to &lt; afterwards for it to work.

HTMLEncode does more than just quotes though by the way, it will remove all html characters such as < and &

so if you actually wanted the text box to store a value "the html encoding for quote mark is &quot;" it would appear as "the html encoding for quote mark is &amp;quot;" in the text and not be automatically converted to a " from the page view. instead of trying to predict what it will do, try actually doing it to see if it solves the problem..

[degsy]

Just to confirm. Using HTMLEncode on the output will not effect the submitted data.
&quot; will be submitted as "

[larkin]

I have been trying it, and it seems to be working for the text boxes. It appears that I don't have to use it for select boxes or text areas.

I am assuming, though, that you meant server.HTMLEncode, because Response.HTMLEncode gave me an error that the object doesn't support that method.

Thank you for your help.

[degsy]

There is not Response.HTMLEncode, only Server.HTMLEncode.
You only need to just it when outputting the data to the browser.

[ghell]

Whoops, sorry.. i knew what i meant :o

[larkin]

One last question. Maybe I should know this, but what if your string is
dim strN = "Ann O'Brien"

and you want to put it in an input that uses single quotes, like:

<input type='text' id='txN' name='txN' value='<%= strN %>' size=50>

I can't use backslash-apostrophe, \', and server.HTMLEncode doesn't seem to have a code for apostrophe.

How do I do this? (or should I just give up and use double quotes?)

[ghell]

thats becuase ' isnt a valid html character to wrap an attribute in and should NOT be used!

you may as well say how come it doesnt do anything when i use
<span style=^hello there^>blah</span>

(the thing for ' is &apos; but just dont use ' or I will send you death threats :D )

infact in XHTML and all XML you have to use " you cant even leave it blank, so you should probably just use " to wrap everything (i know i do)

[larkin]

Ok, I'm getting the picture. I thought apostrophe worked, but this is good to know. Thanks.

[degsy]

thats becuase ' isnt a valid html character to wrap an attribute in and should NOT be used!
' is valid, but not recommended.

http://www.w3schools.com/html/html_elements.asp

[Sheff69]

Hi,

I've been suffering similar when trying to store hidden fields etc. I've found that setting the value as in the subject line above sets the value correctly in the form item and still retains the actual chr(34) character when receiving the form on the server (and hence DB).

Hope this helps.