html code into a mySQL database

adavis

I have a form to input some data into a mySQL table. I would like to allow the user to bold certain statements or words. I notice on most of these bulletin boards that in order to enter any kind of html formatting you enter the appropriate tag surrounded by square brackets ([]) instead sharp brackets (<>). Why is that?

I also need, at times to allow users to enter a single quote into a database table. If they just enter a bare ' they end with a \' being displayed. Any ideas on how to fix that other than entering a & # 1 3 5 ; in place of the single quote

Hikari

The reason that people use square brackets on Bulletin Boards is because the boards often, and rightfully so disable HTML. So, in order to compensate for that they use something called 'vB code', or 'UBB Code' or 'PHPBB Code' - depending on what board you use. It adds some simple codes to enable you some formatting.

So, unless you parase HTML (and you should - html_specialchars) you don't need to use the other codes. If you do choose to however, look at preg_replace for how to make new codes for formatting. There is alot of good info in the commends below.

adavis

I went to php.net and looked at preg_replace. I also looked at reg_replace and str_replace. My thinking is that preg_replace (which seems to be faster to reg_replace) is overkill for what I want to do. I sounds to me like str_replace would be faster and less complicated for my purposes. At least for replacing the tags. All I want to do is replace [ b ] [ /b ] with the html tags and ' with &# 145 ; (  ) on any input.

Hikari

I supose you could do:

$query = str_replace('[[b][/b]b]', '<b>', html_specialchars($_POST['text']));
$query = str_replace('[[b][/b]/b]', '</b>', html_specialchars($_POST['text']));

Where $query is what you're going to throw into the query, and text is the value in the forum.