First of all, it is always better to check for the unwanted characters and get back to the user, than silently stripping them. Say, a user added a quote to their password, you removed it, and so they won't be able to login at all! So it's better to check and tell the user instead:
if (!ctype_alnum($username)) {
$errors[] = "Only letters and numbers allowed in username";
}
...
if ($errors) {
echo "You've got some errors, please fix them: ". implode("<br>", $errors);
} else {
// proceed with normal flow
But in this specific case I would advise against replacing any characters. Imagine Shaquille "Shaq" O'Neal is going to register on your site. What's the point in stripping him of all those quotes? Let alone the password, where use of punctuation is strongly encouraged.
After all, those quotes don't do any harm, if you properly handle them.
for HTML, simply use
htmlspecialchars()withENT_QUOTESattribute:Your username is: <?= htmlspecialchars($username, ENT_QUOTES) ?><br />for SQL, use prepared statements to avoid any problems with quotes
But just for sake of literal answer, here is how to remove quotes (or any other characters and even multi-character substrings) in PHP
$yourVariable = "scor\"pi'on";
$substringsToRemove = ['\'', '"'];
$yourVariable = str_replace($substringsToRemove, "", $yourVariable);
Answer from ScoRpion on Stack OverflowFirst of all, it is always better to check for the unwanted characters and get back to the user, than silently stripping them. Say, a user added a quote to their password, you removed it, and so they won't be able to login at all! So it's better to check and tell the user instead:
if (!ctype_alnum($username)) {
$errors[] = "Only letters and numbers allowed in username";
}
...
if ($errors) {
echo "You've got some errors, please fix them: ". implode("<br>", $errors);
} else {
// proceed with normal flow
But in this specific case I would advise against replacing any characters. Imagine Shaquille "Shaq" O'Neal is going to register on your site. What's the point in stripping him of all those quotes? Let alone the password, where use of punctuation is strongly encouraged.
After all, those quotes don't do any harm, if you properly handle them.
for HTML, simply use
htmlspecialchars()withENT_QUOTESattribute:Your username is: <?= htmlspecialchars($username, ENT_QUOTES) ?><br />for SQL, use prepared statements to avoid any problems with quotes
But just for sake of literal answer, here is how to remove quotes (or any other characters and even multi-character substrings) in PHP
$yourVariable = "scor\"pi'on";
$substringsToRemove = ['\'', '"'];
$yourVariable = str_replace($substringsToRemove, "", $yourVariable);
$keyItem = str_replace ("'","\'",$keyItem);
This replaces a single quote with an 'escaped' single quote \' .
php - str_replace double and single quotes - Stack Overflow
php - str_replace for double quotes simply is not working - Stack Overflow
php string replace quotes - Stack Overflow
str replace - PHP str_replace quotes and double quotes - Stack Overflow
I didn't have a problem with your code, my test is below:
<?php
$input = '"This" is a '."'".'String'."'";
echo $input.'<br />';
//Echos "This" is a 'String'
$output = str_replace('"','\"',$input);
$output = str_replace("'","\'",$output);
echo $output;
//Echos \"This\" is a \'String\'
Edited
Irrelevant now, OP figured it out :D
Try this:
$output = str_replace("\"","\\\"",$input);
$output = str_replace("\'","\\\'",$output);
return $output;
The problem is that ' inside a string, should be noted as \' , as it is an escape character. The backslash \ is a double \ as well inside a string.
Let me know if this works.
$value = str_replace(""", "", $value);
Thanks AbraCadaver
Just reiniterating what someone else suggested, as it worked for both me and the original poster:
$value = str_replace(""", "", $value);
Although, I was dealing with a single quote issue. What is odd is that the output from my php variable produced a ' in the code, not a '. If it were ' that output, it wouldn't break the html attribute I was loading it into. Example: <element attr='''>
Not sure myself how to explain. But, glad it got fixed. Hope the original question gets upvoted as it seems not trivial or without effort, but a confusing situation and understandably so.
Update: I'd agree with others that the following is an easier-to-read alternative for most folks:
$page = str_replace("'", '"', $page);
My original answer:
$page = str_replace(chr(39), chr(34), $page);
You don't need to escape the quote character (in fact it is \, not /, unless you were confused with the standard regex delimiters) if the string isn't delimited with the same character.
$page = str_replace("'", '"', $page);
You really shouldn't do it. You should use PDO and prepared statements or at least mysqli and mysqli_real_escape_string. Using addslashes to insert data to database it's very bad idea.
EDIT
And you shouldn't use mysql functions (I see you tried in your question comment) because they are deprecated already. Use mysqli functions if you don't want to use PDO
$_POST is an array and you can't use string replacement functions for that.
You have to do it directly on the fields themself, for example at $_POST['name']
Hey r/PHPhelp
For one of my class assignments we are coding "parasites" that modify existing code. I have chosen Wikipedia as my source code. I would like to replace every word that is placed in double quotes with a different text (e.g "house of construction" gets replaced with "man of steel"). My current code however is replacing all double quotes in the entire code instead of just those in the text. I hope that makes sense. This is what I have so far (not working as it should):
<?php
$homepage = file_get_contents('wikipedia.html');
$example_tweet[0] = 'I want to make things so beautiful';
$homepage = str_replace('""', $example_tweet[0], $homepage);
echo($homepage);
?>
The MS smart quotes can be removed with this function.
function convert_smart_quotes($string)
{
$search = array(chr(145),
chr(146),
chr(147),
chr(148),
chr(151));
$replace = array("'",
"'",
'"',
'"',
'-');
return str_replace($search, $replace, $string);
}
Or add them to your code:
str_replace(array('<','>',')','\$','(', '?', '.', ',' ,'!', '-', '+', '/', '\*', '\\', '"', chr(145), chr(146), chr(147), chr(148)), " ", $text)
http://shiflett.org/blog/2005/oct/convert-smart-quotes-with-php
What are you trying to do?
There is htmlspecialchars() function that protects all unknown output from breaking HTML.
Hope this helps.
<?php
//left double quote
$temp = str_replace("“","\"",$temp);
$temp = str_replace("“","\"",$temp);
//right double quote
$temp = str_replace("”","\"",$temp);
$temp = str_replace("”","\"",$temp);
?>
This working fine . Tested
$temp = "I want to replace โ and โ characters with the caharacter";
$temp=str_replace("โ",'"',$temp);
$temp=str_replace("โ",'"',$temp);
echo $temp;
OUTPUT
I want to replace " and " characters with the caharacter
You need to escape double quotes in your string literal. There's also an umatched left-parenthesis you need to remove:
<?php
$comments = str_replace('"', "'", "6:00 pm , practiced \"Zen' flying and sit carving (one leg down) and back carving and sit-to-sit front flip (weight require slower wind speed)");
echo $comments;
?>
Output:
6:00 pm , practiced 'Zen' flying and sit carving (one leg down) and back carving and sit-to-sit front flip (weight require slower wind speed)
Edit: Since you've posted more code I see what is going on. Try the following code. It will work unless the content has "LOG_COMMENTS\n" in it somewhere.
$time[] = array(
"entry_id" => "{entry_id}",
"tunnel" => $tunnel,
"tunnel_id" => $tunnel_id,
"entry_date" => "{entry_date}",
"log_time" => "{log_time}",
"log_video" => "{log_video}",
"log_comments" => <<<LOG_COMMENTS
{log_comments}
LOG_COMMENTS
);
Still, this is a very poor design. Is there a reason the CMS can't save data into a database or a plain text file?
Edit {log_comments} to {addslashes(log_comments)}
You need to escape the input of your string you are in the process of building or that string will itself be broken up by the rogue quotes.
What it means to escape a string.
See the docs
Better yet, try to use ' instead of " for the outer quote so you don't have to escape it at all. And concatenate $raiz with your string. The problem is most likely characters that should be escaped in html.
Try this, this works (see this code exactly here):
$changeli = 'li id="head'.$raiz.'" class="head"';
$changeli2 = 'li id="foot'.$raiz.'" class="foot"';
// value of $raiz is "-all" at this point (for clarity of code)
echo $changeli; // result should be li id="head-all" class="head"
echo $changeli2; // result should be li id="foot-all" class="foot"
$footer = htmlspecialchars_decode(str_replace(htmlspecialchars($changeli), htmlspecialchars($changeli2), htmlspecialchars($footer)));
Based on what you said the values of $footer and $raiz are, it's hard to see what's going wrong. For example this program:
<?php
$footer = 'id="<li id="head-all" class="head"><p>The news of the...';
$raiz = '-all';
$changeli = "li id=\"head{$raiz}\" class=\"head\"";
$changeli2 = "li id=\"foot{$raiz}\" class=\"foot\"";
print "(BEFORE) Footer: $footer\n";
$footer = str_replace($changeli, $changeli2, $footer );
print "(AFTER) Footer: $footer\n";
produces this output:
(BEFORE) Footer: id="<li id="head-all" class="head"><p>The news of the...
(AFTER) Footer: id="<li id="foot-all" class="foot"><p>The news of the...
There are many characters that look like quotation marks, most of them are used infrequently. The ones that are used more often are these three:
" U+0022 QUOTATION MARK
โ U+201C LEFT DOUBLE QUOTATION MARK
โ U+201D RIGHT DOUBLE QUOTATION MARK
Some rarer ones are FULLWIDTH QUOTATION MARK, the DITTO MARK, the DOUBLE PRIME, the DOUBLE PRIME QUOTATION MARK, and so on. The Unicode.org "confusables" tool finds 15 characters similar to ".
Why don't you copy and paste the offending character here so we can identify it? Or you could use the HEX function to get the hexadecimal encoding of the character, that's another way of identifying it.
Update The unicode.org confusables utility seems to be down, but the data is available as a text file. The current list of characters that are "confusable" with double quote are:
1CD3 ; 0027 0027 ; MA #* ( แณ โ '' ) VEDIC SIGN NIHSHVASA โ APOSTROPHE, APOSTROPHE # โโณโโ"โ
0022 ; 0027 0027 ; MA #* ( " โ '' ) QUOTATION MARK โ APOSTROPHE, APOSTROPHE #
FF02 ; 0027 0027 ; MA #* ( ๏ผ โ '' ) FULLWIDTH QUOTATION MARK โ APOSTROPHE, APOSTROPHE # โโโโ"โ
201C ; 0027 0027 ; MA #* ( โ โ '' ) LEFT DOUBLE QUOTATION MARK โ APOSTROPHE, APOSTROPHE # โ"โ
201D ; 0027 0027 ; MA #* ( โ โ '' ) RIGHT DOUBLE QUOTATION MARK โ APOSTROPHE, APOSTROPHE # โ"โ
201F ; 0027 0027 ; MA #* ( โ โ '' ) DOUBLE HIGH-REVERSED-9 QUOTATION MARK โ APOSTROPHE, APOSTROPHE # โโโโ"โ
2033 ; 0027 0027 ; MA #* ( โณ โ '' ) DOUBLE PRIME โ APOSTROPHE, APOSTROPHE # โ"โ
2036 ; 0027 0027 ; MA #* ( โถ โ '' ) REVERSED DOUBLE PRIME โ APOSTROPHE, APOSTROPHE # โโตโตโ
3003 ; 0027 0027 ; MA #* ( ใ โ '' ) DITTO MARK โ APOSTROPHE, APOSTROPHE # โโณโโ"โ
05F4 ; 0027 0027 ; MA #* ( โืดโ โ '' ) HEBREW PUNCTUATION GERSHAYIM โ APOSTROPHE, APOSTROPHE # โ"โ
02DD ; 0027 0027 ; MA #* ( ห โ '' ) DOUBLE ACUTE ACCENT โ APOSTROPHE, APOSTROPHE # โ"โ
02BA ; 0027 0027 ; MA # ( สบ โ '' ) MODIFIER LETTER DOUBLE PRIME โ APOSTROPHE, APOSTROPHE # โ"โ
02F6 ; 0027 0027 ; MA #* ( หถ โ '' ) MODIFIER LETTER MIDDLE DOUBLE ACUTE ACCENT โ APOSTROPHE, APOSTROPHE # โหโโ"โ
02EE ; 0027 0027 ; MA # ( หฎ โ '' ) MODIFIER LETTER DOUBLE APOSTROPHE โ APOSTROPHE, APOSTROPHE # โโณโโ"โ
05F2 ; 0027 0027 ; MA # ( โืฒโ โ '' ) HEBREW LIGATURE YIDDISH DOUBLE YOD โ APOSTROPHE, APOSTROPHE # โโืืโโ
I was searching for the Double low quote character but it was not listed in the above answers. Finally found it, so I'm sharing it to save some time:
โ A nice quotation โ
โ = Double low quote / „ / „ / „ / U+201E
โ = Right Double Quotation / ” / ” / ” / U+201D
str_replace()
echo str_replace('"', '', $a);
if string is: $str = '"World"';
ltrim() function will remove only first Double quote.
Output: World"
So instead of using both these function you should use trim().
Example:
$str = '"World"';
echo trim($str, '"');
Output-
World