Single or double quotes in PHP?

Question

In general which is safer to use, with regards to XSS evasion in particular?

echo '<input name="'.$input_name.'">';
echo "<input name='$input_name'>";

I'm guessing single quotes, but wondering why & hoping to find recommended reading.

Answer 1

It doesn't make a difference if used correctly.

The first version is standard though. Single quotes are less often used around HTML attribute values, so you need to be a bit more careful when using various functions meant to protect against XSS, as they may not necessarily take this case into consideration.

htmlspecialchars for example does not encode ' by default, you need to specifically set ENT_QUOTES. Any custom function your project or framework may use may have the same problem.

Answer 2

Even if you use " in PHP you don't need to use ' in HTML. I'd recommend

echo "<input name=\"$input_name\">";

or even

echo "<input name=\"".$input_name."\">";