Hidden Fields Not Working

Anon

Hi all...

Basically I'm trying to have a user input data (which can be HTML formatted) into a TEXTAREA on one screen, click a Preview button, review their input, and if everything is okay, click a button and have it update the database.

The problem I'm having is that if I put a web link, i.e. <A HREF="www.yahoo.com">Yahoo</A> in my TEXTAREA, then the next screen has some part of the text from that link popping up in a weird place.

I know that the problem is coming from the hidden variable on line 16 in the show.php file, but I can't figure out how to get around it. I definitely need to pass those hidden variables along to the do_add.php script. You can test this out by first typing anything in the add.php form and trying it, and then putting an <A HREF link in and seeing what it does.

I'd really appreciate any help because this one is definitely causing some heartache. Thanks in advance...

-Gary

Here's the code...

CALL THIS add.php

<HEAD>
<TITLE></TITLE>
</HEAD>
<BODY BGCOLOR="#ffffff">
<CENTER>
<?php

echo ("<H2>Please Input Some Text</H2>");
echo "<FORM enctype=\"multipart/form-data\"
action=\"show.php\" method=\"post\">";
echo ("<P><H3>Title</H3>");
echo "<INPUT TYPE=\"text\" name=\"title\" size=80>";
echo ("<P><H3>Date (YYYY-MM-DD)</H3>");
echo "<INPUT TYPE=\"text\" name=\"rel_date\" size=12>";
echo ("<P><H3>Body (<FONT COLOR=\"#ff0000\">
HTML formatted </FONT>) </H3>");
echo "<PRE><TEXTAREA name=\"body\" rows=30 cols=80 wrap=\"virtual\">";
echo "</TEXTAREA></PRE>";
echo "<P><INPUT TYPE=submit value=\"Preview \">";
echo "</FORM>";
?>
</BODY>

CALL THIS show.php

<HEAD>
<TITLE></TITLE>
</HEAD>
<BODY BGCOLOR="#ffffff">
<CENTER>
<H2>This is what it looks like</H2>
<FORM ACTION="do_add.php" METHOD="post"
enctype=\"multipart/form-data\">
<INPUT TYPE="button" VALUE="Edit" onClick="history.go(-1)">
<INPUT type="submit" VALUE="Add Press Release">
<?php
echo ("<INPUT TYPE=\"hidden\" NAME=\"title\" VALUE=\"$title\">");
echo ("<INPUT TYPE=\"hidden\" NAME=\"rel_date\" VALUE=\"$rel_date\">");
echo ("<INPUT TYPE=\"hidden\" NAME=\"pr_num\" VALUE=\"$pr_num\">");
echo ("<INPUT TYPE=\"hidden\" NAME=\"body\" VALUE=\"$body\">");
echo ("<INPUT TYPE=\"hidden\" NAME=\"action\" VALUE=\"$action\">");

echo ("</FORM>");
echo ("<BR><P>");

$temp_title = stripslashes($title);
$temp_body = stripslashes($body);
echo ("<br>$temp_title - $rel_date");
echo ("<br><P>$temp_body");
?>

Anon

OK, all you have to do is use ereg_replace then strip_slashes and you should get what you want.

CALL THIS show.php

<HEAD>
<TITLE></TITLE>
</HEAD>
<BODY BGCOLOR="#ffffff">
<CENTER>
<H2>This is what it looks like</H2>
<FORM ACTION="do_add.php" METHOD="post"
enctype=\"multipart/form-data\">
<INPUT TYPE="button" VALUE="Edit" onClick="history.go(-1)">
<INPUT type="submit" VALUE="Add Press Release">
<?php
$body = ereg_replace("\"", "'", $body);
$body = stripslashes($body);
echo ("<INPUT TYPE=\"hidden\" NAME=\"title\" VALUE=\"$title\">");
echo ("<INPUT TYPE=\"hidden\" NAME=\"rel_date\" VALUE=\"$rel_date\">");
echo ("<INPUT TYPE=\"hidden\" NAME=\"pr_num\" VALUE=\"$pr_num\">");
echo ("<INPUT TYPE=\"hidden\" NAME=\"body\" VALUE=\"$body\">");
echo ("<INPUT TYPE=\"hidden\" NAME=\"action\" VALUE=\"$action\">");

echo ("</FORM>");
echo ("<BR><P>");

$temp_title = stripslashes($title);
$temp_body = stripslashes($body);
echo ("<br>$temp_title - $rel_date");
echo ("<br><P>$temp_body");
?>

This will now display <A HREF="www.yahoo.com">Yahoo!</A> as <A HREF='www.yahoo.com'>Yahoo!</A> All this did was erase the " and replace it with ' but then we have the whole problem of the slashes so thats where strip_slashes comes in. Hope all this helps!

Anon

am i right in thinking that it's the html code you want to be visible in the preview?

in which case you want to use htmlspecialchars() on it before you echo it.

remember, though, it's very hard to reverse this, so it's wise to do it to a different copy of the string to that which you are going to save!

--
rad