Take the 2-minute tour ×

I am writing some javascript code that uses a string rendered with PHP. How can I escape single quotes (and only single quotes) in my PHP string?

<script type="text/javascript">
    $('#myElement').html('say hello to <?php echo $mystringWithSingleQuotes ?>');
share|improve this question
You'll need to escape more than single quotes. Newlines, for one. You might do well with something like addcslashes($mystringWithSingleQuotes, "'\"\r\n\\\t\0..\37") –  Frank Farmer Jun 7 '11 at 17:27
Instead of handling the escaping yourself, use json_encode() to get a valid Javascript string (and remove your outer single quotes). –  mario Jun 7 '11 at 17:29
@Frank: Can you post your answer as an answer instead of as a comment? Proper answers in comments can not be selected and therefore creates fake "unanswered questions". –  Sylverdrag Jun 7 '11 at 17:33

7 Answers 7

up vote 23 down vote accepted

Quite simply: echo str_replace('\'', '\\\'', $myString); However, I'd suggest use of JSON and json_encode() function as it will be more reliable (quotes new lines for instance):

$data = array(
   'myString' => '...'

   var phpData = <?php echo json_encode($data) ?>;

share|improve this answer
Thank you.. I knew this but I was facing problem because I was trying to do JSON.parse('<?php echo json_encode($data);?>'); and it was failing because there was a single quote inside data. Later I came to know there is no need to use JSON.parse here. –  Ravi Dhoriya ツ Jan 16 at 12:00

All of the answers that say str_replace("'","\\'", $string) and similar are incorrect. Consider the string


It will be replaced with


and this will cause an injection vulnerability. Instead use json_encode as Crozin suggests.

share|improve this answer
str_replace("'", "\'", $mystringWithSingleQuotes);
share|improve this answer

To replace only single quotes, use this simple statement:

$string = str_replace("'","\\'", $string);
share|improve this answer
Wow this solved my problem regarding mgic_qoute –  AlexJaa Aug 20 '14 at 10:35

Not sure what exactly you are doing with your data, but you could always try:

$string = str_replace("'","%27", $string);

I use this whenever strings are sent to a database for storage. %27 is the encoding for the ' character, and it also helps to prevent disruption of GET requests if a single ' character is contained in a string sent to your server. I would replace ' with %27 in both javascript and PHP just in case someone tries to manually send some data to your PHP function. To make it prettier to your end user, just run an inverse replace function for all data you get back from your server and replace all %27 substrings with '.

Happy injection avoiding!

share|improve this answer

Here is how I did it. Silly but simple.

$singlequote = "'";
$picturefile = getProductPicture($id);

    echo showPicture('.$singlequote.$picturefile.$singlequote.');

I was working on outputing HTML that called a javascript to show a picture...

share|improve this answer

After a long time fighting with this problem, I think have found the better solution. Combine two functions make possible escape a string to use as HTML. One to escape double quote if you use the string inside a javascript function call, and other to escape the single quote to avoid those simple quote that go around the argument.

Solution: mysql_real_escape_string(htmlspecialchars($string))

Solve: - a php created to call a javascript function like

echo 'onclick="javascript_function(\''.mysql_real_escape_string(htmlspecialchars($string))"'

share|improve this answer

Your Answer


