how to pass special characters form parent to child window

kay

hello there! i am having problem in calling the escape and unescape functions.
i have a button in my form which opens a new window. upon clicking the said button, it should pass the string $title to the new window thru url. however, the string accepts special characters and some special characters cause problems everytime they are passed thru url. i believe that strings with special characters must be escaped first then unescape (to the new window) for it to be displayed properly.

here is a sample of the code: (php)

$title = $results["Title"];

<input type="text" name="Title" size="50" value=" <? echo $title;?> ">
<input type="button" name="pick" value="Send" onClick = "window.open('modtitle.php?OpenForm&title=<? echo $title?>&actione=load','new_win','width=400,height=300');">

</form>

the problem: where will i insert the function that will escape the string $title that will be passed thru url.

on the other hand, at my new child window, the string $title must be placed in a textarea.

the problem: how will i unescape the string $title to be displayed in the textarea in my new window.

please help....

sfullman

there's no reason you can't use urlencode($title) to get it into the query string. That'll pass just fine and the browser will automatically decode it so that if the title was:

Engine, Engine #9, Comin' down the railroad line :-)

it would be urlencoded to %nn for the wierd stuff like %20 for the space, and other things for # and , and ' and : and etc.

However on the next page if you were to echo:

echo $title

You'd get our old friend engine #9 again.

WHY ARE YOU PASSING A TITLE ANYWAY? HOW BOUT AN ID TO A DATABASE WHICH FETCHES THIS?

ALSO (YOU'RE NOT DONE YET), don't forget to escape a doulbe quote ("). If your title was

Duh, what does </textarea> mean?"

and you echoed that into the text area, you'd only get:

Duh, what does

So instead of:
<textarea name=blah><?php echo $title?></textarea>

use this:

Best,
SAm

kay

hi sfullman! i did what u have suggested and it helped me a lot. i used the urlencode() and htmlentities() functions. thanks so much for that.

however, there are some problems i have encountered. in the system, the user can able to bold, italicize, underline, superscript and subscript a certain part of the title or if not the whole title. If the user applies this functions in the title, the text should appear as what they have applied (just like in MSword).

the problem occurs when i use <? echo htmlentities($title); ?>

say the title is "hello world every<one>!"

the user, take for example, bolds the word world. when i use <? echo $title ?>, the title appeared to be:

"hello world every!" (note that this is no longer located in the textarea anymore)

but when i use <? echo htmlentities($title) ?>, the title appeared to be:

"hello <b>world</b> every<one>!"

what i need to appear here should be:

"hello world every<one>!"

when using htmlentities(), is there a way for me to trap bold,italics,underline,superscript and subscript tags with any other html tags? is there any way that <b></b>,<i></i>,<u></u>,<sub></sub>,<sup></sup> tags not to appear when i use htmlentities?

please help again....thanks.

sfullman

If you give someone textarea acess to HTML, they have to understand HTML. No other way. If you remove the <b> tag for example, when they submit there's no way of knowing what's bold if the <b>tag isn't THERE.

For displaying just html (page) output, don't USE htmlentites() as you don't need it.

Be careful the user doesn't pass malicous <?php ?> tags too.

Sam

kay

hi sam!

i'm supposed to display the title in an html page not in a textarea. Using plain <? echo $title; ?> does not display < sign and all texts after it, unless there is space between the < sign and the text.

example:

$title =" london <b>bridge</b> is "falling" <down ";
echo $title;

in an html page title would appear as:

london bridge is "falling"

how can i display the string:

london bridge is "falling" <down

correctly? (that is <b> tags must not show)

also, why are some of my special characters like alpha,beta,ellipsis,dagger, etc do not appear to be as it is? they are replaced by some other special characters?

kay

sfullman

Look, Kay, you either have to have all html, in which case the writer needs to know what they're doing, or all text, in which you change it to htmlentities.

In the first case, whoever's writing it needs to know that to SHOW a < sign, you need to write it < -- that needs to be their responsibility. Then they get the <b> bold stuff </b> and can show a < as well.

In the second case, you invoke htmlentities on everything; they can't write any html. You should also check out the function nl2br() which will change their return chars into line breaks (i.e. <br>).

Your only other option is to agree on CERTAIN accepted html tags, let them write it as text, but do something special to the tags.

e.g.:

//here's the text
$text = "london <b>bridge</b> is \"falling\" < down";

//replace certain items
$text = str_replace('<b>','',$text);
$text = str_replace('</b>','',$text);
$text = str_replace('<i>','',$text);
$text = str_replace('</i>','',$text);

//make the change, and will survive
$text = htmlentities($text);

//now that the coast is clear, change the exceptions back
$text = str_replace('','<b>',$text);
$text = str_replace('','</b>',$text);
$text = str_replace('','<i>',$text);
$text = str_replace('','</i>',$text);

once again, either treat it as all html or all text, or you'll have to resort to those type of things.

Sam

kay

i have an idea. can i just change < signs to < in my code? BUT it has to SKIP all html's bold, italics, underline, superscript and subscript tags? in that way all < signs that are not html tags will be treated as < and upon echoing it, it will display as i wanted it to be. am i making any sense? if i am, can you give me some tips and help on how to implement it? many thanks!😉
hope you won't get tired of answering my questions...