title: Escape quotes from the results of a SQL Server query
body: <p>I have this PHP code that executes a query.</p>
  
  <pre><code>$sql = "SELECT ACCOUNTNUM as AccountNumber, NAME AS CompanyName
  FROM VENDORTABLE";
  
  $stmt = sqlsrv_query( $conn, $sql );
  
  if( $stmt === false) {
      die( print_r( sqlsrv_errors(), true) );
  }
  </code></pre>
  
  <p>And I then use the results from the query to populate a datalist:</p>
  
  <pre><code>&lt;form method="POST"&gt;
  
  &lt;label for="A"&gt;Number/Name:&lt;/label&gt;&lt;br&gt;
  &lt;input list="A" name="name"&gt;
  &lt;datalist id="A"&gt;
    &lt;?php
      while( $row = sqlsrv_fetch_array( $stmt, SQLSRV_FETCH_NUMERIC) ) { ?&gt;
        &lt;option value='&lt;?php echo $row[0].",".$row[1] ?&gt;'&gt;&lt;?php
      }
    ?&gt;
  &lt;/datalist&gt;&lt;br&gt;&lt;br&gt;
  
  &lt;input type="submit" value="Continue""&gt;
  
  &lt;/form&gt;
  </code></pre>
  
  <p>The problem is some of the results have characters that HTML doesn't like (namely ' and ") and those reults get cut off ("Mike's" becomes "Mike", for example) when the loop puts them into the datalist. </p>
  
  <p>How can I make it so that what gets put into the datalist includes the whole result and any quotes that are present in the data?</p>
  
  <p>I've tried doing this:</p>
  
  <pre><code>&lt;?php
      while( $row = sqlsrv_fetch_array( $stmt, SQLSRV_FETCH_NUMERIC) ) { ?&gt;
        &lt;option value='&lt;?php echo $row[0].",".htmlspecialchars($row[1]) ?&gt;'&gt;&lt;?php
      }
    ?&gt;
  </code></pre>
  
  <p>Also with addslashes() instead of htmlspecialchars(), the former just adds a slash on the first occurrence of a quote but still cuts off everything after that</p>