Escape quotes in a variable with PHP

Question

I use this code to genefate html

echo "<input type='button' onclick=\"myFunc('$param');\" />";

Everything would be OK unless $param contains ' or " character. How should it be implemented to handle these situations?

ps. mysql_real_escape_string($param) won't work correctly, when a user entered ".

Answer 1

There are a couple of functions that could be used:

<?php
$string = 'string test"';

echo htmlentities($string) . "\n";
echo addslashes($string) . "\n";

They produce the following:

string test"
string test\"