title: Special characters with in php - javascript - ajax
body: <p>I have simple comment script that enable to add / edit / remove comments. I have a problem with special characters.</p>
  
  <p>If var currentMessage contains ' or " then the code breaks.</p>
  
  <p>I save the comments in the db as follows : </p>
  
  <p>$Message = clean_data($_POST["txtmessage"]); 
  Then do a typical mysqli_query save ....</p>
  
  <pre><code>function clean_data($input) {
      $input = trim(htmlentities(strip_tags($input,",")));
      if (get_magic_quotes_gpc())
      $input = stripslashes($input);
      $input = stripslashes($input);
      $input = htmlspecialchars($input, ENT_IGNORE, 'utf-8');
      $input = trim($input);
      $sqllink = new mysqli(MySQL_Host, MySQL_UserName, MySQL_Password, MySQL_Database);
      $input = mysqli_real_escape_string($sqllink, $input);
      no_magic_quotes($input);
  $input = str_replace("'", "&amp;#39;", $input);
      $input = str_replace("&amp;", "&amp;#38;", $input);
      $input = str_replace('"', "&amp;#34;", $input);
      $input = strip_tags($input);
      return $input;
  }
  </code></pre>
  
  <p>The data saved in MySQL is as follows : <code>let&amp;#38;#39;s do it !</code></p>
  
  <p>My edit button is like this:</p>
  
  <pre><code>&lt;button id="BtnEdit_&lt;?php echo $r_c['CommentID']; ?&gt;" class="btn btn-xs btn-warning" onClick="showEditBox(this,&lt;?php echo $r_c['CommentID']; ?&gt;)" name="edit"&gt;&lt;i class="fas fa-edit"&gt;&lt;/i&gt; &lt;? echo _("To Edit"); ?&gt;&lt;/button&gt;
  </code></pre>
  
  <p>My message displayed like this:</p>
  
  <pre><code>&lt;div class="message-content"&gt;&lt;? echo $r_c['Message']; ?&gt;&lt;/div&gt;
  </code></pre>
  
  <p>If I show the special characters in php echo, then the javascript doesn't work. If I remove all ' or "" then it's ok. But it is not practical.</p>
  
  <pre><code>function showEditBox(editobj,id) {
      $('#BtnEdit_'+ id).hide();
      $('#frmAdd').show();
  
      var currentMessage = $("#message_" + id + " .message-content").html();
      var editMarkUp = '&lt;input type="text" class="form-control input-sm" name="txtmessage" id="txtmessage_'+id+'" value="'+currentMessage+'"&gt;&lt;br&gt;&lt;div class="btn-group pull-left"&gt;&lt;button class="btn btn-xs btn-success" name="ok" onClick="callCrudAction(\'edit\','+id+')"&gt;&lt;i class="fas fa-check"&gt;&lt;/i&gt; &lt;? echo _("Save"); ?&gt;&lt;/button&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;button class="btn btn-xs btn-default" name="cancel" onClick="cancelEdit(\''+currentMessage+'\','+id+')"&gt;&lt;i class="fas fa-times"&gt;&lt;/i&gt; &lt;? echo _("Cancel"); ?&gt;&lt;/button&gt;&lt;/div&gt;';
      $("#message_" + id + " .message-content").html(editMarkUp);
  }
  </code></pre>
  
  <p>The data is displayed as follows : let\'s do it ! (it would be better if it would be - let's do it !)</p>
  
  <p>The edit button doesn't even work if there is ' in a comment.</p>