Formating numbers in a form after retrieving from an SQL database

Question

Hello everyone,
I am using php to populate a form using numbers taken from an sql database.  I am having a hard time showing decimal places in those numbers.  The code I am using in the value section of the form is:
value="<?php if (isset($_POST['unit_price_1'])) {
     echo htmlentities( $_POST['unit_price_1'], ENT_COMPAT, 'UTF-8');
     } else {
          echo htmlentities($row_getInvoice['unit_price_1'], ENT_COMPAT, 'UTF-8');
     } ?>" />
This code rounds all numbers up and eliminates decimal places.  I am trying to show dollars and cents.
How do I alter the code to accomplish what I want.
Jeff

Answer 1

Not sure what might come in your way here, so I just made the following simple test by using a static value rather than one which gets derived from a recordset (the source shouldn´t matter), and this works well for me without seeing the value altered in any way:
<?php
$value = "10.22";
?>
<input type="text" name="whatever" value="<?php echo htmlentities($value, ENT_COMPAT, 'UTF-8'); ?>" />
However,. for displaying numeric values you really don´t need to use  htmlentities/ENT_COMPAT etc etc -- that´s something you´d rather use for displaying textual contents containg special characters like umlauts and such.
If all you need is to add some degree of protection by escaping special HTML characters (<, >, &, etc.), the function htmlspecialchars() will only be escaping just these characters and leave the rest "as is", whereas htmlentities() is notably more rigi, because this function will convert all applicable characters to HTML entities -- but again: at this point you´re just *displaying* some numeric value, that is, such security measures are pretty much pointless in this scenario, because there´s nothing to protect from ;-)
Please test what happens when doing away with the htmlentities - thing.
Cheers,
Günter