The extra single quotes are escape characters.
The value cannot be changed. Literal characters are enclosed in single quotes, literal strings in double quotes.
However, all parameter values are enclosed in single quotes, which makes the contents within the quotes a literal string.
Variable substitution is not done in text literals which are surrounded by single quotes (apostrophe s).
For example, with Apache you could use a Mod_Security filter such as SecFilterSelective THE_REQUEST "( '| ") "to look for single quotes and double quotes in strings and disallow them."
In order to enter a single quote into a text literal surrounded by single quotes, or a double quote into a literal surrounded by double quotes, prefix it with a backslash character.
If the parameter is a character-based input parameter, then you would specify the literal value surrounded in single quotes.
The careful reader will realize that this may fail badly if the passed argument includes single quotes.
You should also notice that each value term is surrounded by single quotes, exemplified by this full-text query: word='hello'.
When you set a value for the MCAUSER attribute, enclose the value in single quotes to avoid issues with case sensitivity on distributed platforms.
The translator obviously does not know what code will manipulate the translated text, so they must know how to enter required single quotes or apostrophes.
Passing the ENT_QUOTES argument to htmlspecialchars to ensure that single quotes (') are also escaped isn’t strictly necessary in this case, but it’s a good habit to get into.
