PHP function echoes unexpected HTML value

Question

I have a piece of php code inside html tag which is supposed to change the tag's style in accordance with the contents of the URL.

There is an html login form which looks like this:

<form class="userdata" action="login.php" method="post">
    <input type="text" name="email" placeholder="E-mail" <?php fillin('email'); enlight_unfilled('email');?>><br>
    <input type="password" name="pwd" placeholder="Password"><br>
    <button type="submit" name="login-submit">Login</button>
</form>

Here are the functions fillin and enlight_unfilled:

<?php
function fillin($key) {
    if (isset($_GET[$key])) echo "value=".$_GET[$key];
    else echo NULL;
}

function enlight_unfilled($key) {
    if (isset($_GET['error']))
        if (isset($_GET[$key]) and $_GET[$key] !== "") echo NULL;
        else echo "style='border-color: red'";
    else echo NULL;
}
?>

If I only apply one of the functions within the tag, they both do what they are expected to – either save the email in the field if it has been already typed in or enlighten the email field if it has been left empty. But if I apply them together, when the field is empty, php assigns the field value 'style='border-color:. I also tried to use functions like print and printf, but the result is the same:

I am a beginner at php coding and mixing it with html, so the question may appear to be dumb, but I did not manage to find any sort of a solution to this issue, so thanks for help and patience in advance!

Answer 1

It looks like you don't properly encase value in quotes, so it just renders the 'style='border-color:.

Let's assume that $_GET[$key] has a value of hello@hello.com. What your PHP & HTML renders is the following:

value=hello@hello.com

See the problem? There are no quotes. That's why the renderer goes forward searching for a valid value. To fix the issue you must add quotes around your $_GET[$key] in the fillin function. Something like this should do the job:

if (isset($_GET[$key])) echo "value='".$_GET[$key] . "'";

It works when ran alone because it reaches the end > and just assumes the value to be hello@hello.com