In general which is safer to use, with regards to XSS evasion in particular?

echo '<input name="'.$input_name.'">';
echo "<input name='$input_name'>";

I'm guessing single quotes, but wondering why & hoping to find recommended reading.


It doesn't make a difference if used correctly.

The first version is standard though. Single quotes are less often used around HTML attribute values, so you need to be a bit more careful when using various functions meant to protect against XSS, as they may not necessarily take this case into consideration.

htmlspecialchars for example does not encode ' by default, you need to specifically set ENT_QUOTES. Any custom function your project or framework may use may have the same problem.


Even if you use " in PHP you don't need to use ' in HTML. I'd recommend

echo "<input name=\"$input_name\">";

or even

echo "<input name=\"".$input_name."\">";

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.