If the parameter is a character-based input parameter, then you would specify the literal value surrounded in single quotes.
The translator obviously does not know what code will manipulate the translated text, so they must know how to enter required single quotes or apostrophes.
However, all parameter values are enclosed in single quotes, which makes the contents within the quotes a literal string.
The careful reader will realize that this may fail badly if the passed argument includes single quotes.
The extra single quotes are escape characters.
In order to enter a single quote into a text literal surrounded by single quotes, or a double quote into a literal surrounded by double quotes, prefix it with a backslash character.
The value cannot be changed. Literal characters are enclosed in single quotes, literal strings in double quotes.
When you set a value for the MCAUSER attribute, enclose the value in single quotes to avoid issues with case sensitivity on distributed platforms.
You should also notice that each value term is surrounded by single quotes, exemplified by this full-text query: word='hello'.
Passing the ENT_QUOTES argument to htmlspecialchars to ensure that single quotes (') are also escaped isn’t strictly necessary in this case, but it’s a good habit to get into.
For example, with Apache you could use a Mod_Security filter such as SecFilterSelective THE_REQUEST "( '| ") "to look for single quotes and double quotes in strings and disallow them."
Variable substitution is not done in text literals which are surrounded by single quotes (apostrophe s).
國文精選館
