How to properly escape password field on HTML form?
<p>Input field for password usually accepts a wide range of characters compared to text inputs. The normal way of escaping an input on HTML form involves using <code>htmlspecialchars($_POST['content'])</code> on the input contents.</p>

<p>What if, in the scenario of a failed validation of a password update process, I require the new password to repopulate on the HTML form? Something like <code>'&gt; yeah</code> would have caused the form to malfunction and using <code>htmlspecialchars</code> would produce a totally different password.</p>

<p>Any suggestions?</p>

<p>The html portion as shown:</p>

<pre><code>&lt;INPUT type=password name=password1 value=''&amp;gt;&amp;lt;script&amp;gt;try' size=15 maxlength=15&gt;
</code></pre>

<p>The corresponding php code:</p>

<pre><code>function h($str) {echo htmlspecialchars($str);}
echo "&lt;INPUT type=password name=password1 value='", h(@$_POST['password1']), "' size=15 maxlength=15&gt;";
</code></pre>

<p>Blank is shown in the form input field.</p>

<p><strong>UPDATE</strong></p>

<p>The problem lies with my <code>htmlspecialchars</code> which does not escape single quotes by default. Now adding the <code>ENT_QUOTES</code> parameters allow the single quote to be escaped and solve my problem. deceze and CodeCaster are right that <code>htmlspecialchars</code> does not change the password. Thanks all.</p>
