displaying what's entered

robsgaming

Quick question... I have made my own cheap discussion forums. However, I know that if a user chooses to put HTML in a message it will display it on the board, in some cases causing it to mess up how the page looks, etc.

How can I display EXACTLY what is entered in a form from the database and have it not parse html?

Thanks in advance.

Rob

_SuperString

highlight_string will do the job !!

su1d

http://php.net/htmlentities
http://php.net/htmlspecialchars

robsgaming

so say $message has html in it from a user--

$message = highlight_string($message);

will do the trick?

_SuperString

as long as its enabled in the php ini file then you should have no problems. look at phpinfo() to see if its configured.

robsgaming

ok the highlight didn't work the way i wanted but

$message = htmlspecialchars($message);

worked perfect.

Two more things... then I'm done. I promise. Say a user inserts <a href="blahbalH">blah</a> or a <BR> or <P> tag... I still want those to convert to html, nothing else though like if they decieded to put in a </table> to screw up the page. How would this be possible?