preventing html in user input-data

[shumway]

Hi.

Im building a forum and must ofcourse prevent the users from including html-code or other hazardous things in their submits.

In ASP I used: Server.HTMLEncode( Whatever ) when displaying the user inputs.
Is there an eqvivalent in php or is there any other way to solve this?

tx!

[Kerry_Kobashi]

Check out

htmlspecialchars() and htmlentities()

Is that what you are looking for?

Kerry Kobashi
Kobashi Computing

[shumway]

htmlentities seems to be working fine.

But... I would also want CR och LF (enter in a textarea) translated into <br> - is there a function for this also?

And one more thing - is there a function who calculates the pixel-width of a string so I can cut it if it doesnt fit in my list instead of messing up my table-layout?

and thanks again!

[Kerry_Kobashi]

Check out

nl2br()

You may also want to consider this:

function NewlineToBreak($str)
{
$changeStr = preg_replace("/(\015\012)|(\015)|(\012)/","<br />",$str);
return($changeStr);
}

Kerry Kobashi
Kobashi Computing