Htmlspecialchars & ENT_QUOTES not working?

Question

Basically, when displaying data from a MySQL database, I have a function htmlspecialchars()below that should convert single and double quotes into their safe objects. The problem I ran into is looking at the source code, it only converts < > &when I also need to convert single and double quotes.

//sanitize data from db before displaying on webpage
function htmlsan($htmlsanitize){
    return $htmlsanitize = htmlspecialchars($htmlsanitize, ENT_QUOTES, 'UTF-8');
}

Then when I want to use, for example, I:

htmlsan($row['comment']);

Can someone tell me why it does not convert single and double quotes?

UPDATE

Which is strange: it is htmlsan()used for comments in email, and when I look at the source code of the email, it converts them, it seems that it will not convert single / double quotes from the database when displayed on a web page. My database setup is also set to utf8_general_ci, and I declare that I will use utf8 to connect to the database, etc.

Answer 1

How do you test it for sure?

<?php

//sanitize data from db before displaying on webpage
function htmlsan($htmlsanitize){
    return $htmlsanitize = htmlspecialchars($htmlsanitize, ENT_QUOTES, 'UTF-8');
}

var_dump(htmlsan('<>\'"'));

... prints:

string(20) "<>'""

I assume your input line comes from Microsoft Word and contains typos:

var_dump(htmlsan('"foo"')); // string(9) ""foo"" 

If you need to convert them for any reason, you need htmlentities(), not htmlspecialchars():

var_dump(htmlentities('"foo"', ENT_QUOTES, 'UTF-8')); // string(17) "“foo”"

Update # 1

, . (') comment :

var_dump(bin2hex("'"));
var_dump(htmlspecialchars("'", ENT_QUOTES, 'UTF-8'));
var_dump(bin2hex($row['comment']));
var_dump(htmlspecialchars($row['comment'], ENT_QUOTES, 'UTF-8'));

:

string(2) "27"
string(6) "'"
string(2) "27"
string(6) "'"

, , .

# 2

, , , , :

string(6) "'"

6 . real: . , , .. string(6) "'". ' -, '. " " , .

Answer 2

Firebug, Firebug , -, , , View Source . . .

Answer 3

. utf-8_unicode_ci html- utf-8, htmlentities , . , db, html , . charset html iso-8859-1, . , . db - utf-8_unicode_ci.

Answer 4

, , $htmlsanitize.

function htmlsan($htmlsanitize){
    return htmlspecialchars($htmlsanitize, ENT_QUOTES, 'UTF-8');
}

Answer 5

htmlentities($htmlsin, ENT_QUOTES, 'UTF-8');

mb_convert_encoding($htmlsan, "HTML-ENTITIES", "UTF-8");

, , .