disable code in forms?

[akrocks_extreme]

how can i disable html/php/ect. code that has been entered into textboxes? i dont actually mind the fact that its code... in other words, how can i allow them to enter code, but not allow the code to be ran... kinda like on these forums, you can post code so others can see it... but it never runs.

if worse comes to worse i can just filter out all characters like < > $ ; " ' ect. anyways i must filter % because its an object seperator in my files. so if that happens how can i, without using javascript, have a message box saying you cant use those when they press submit?

😕

[drawmack]

http://www.php.net/htmlentities

[akrocks_extreme]

ok! thanks for the quick response! that looks like it will solve part of my problems 😃 but! how can i convert them before i send them POST over a form? because i think thats where they are getting messed up.

[Weedpacket]

You can't, without Javascript (or some other client-side programming - and who uses anything else?).

What makes you think they're getting "messed up" in the form? And in what way are they getting "messed up"?

[akrocks_extreme]

ok, i have about 3 things happening on 1 php page.

First, the user enters in a question and 4 choices and selects the one that is the correct answer with a radio dial, then they click the button which takes us to step 2 of the page.

the same answers and question boxes are still there, and below it, it shows all the previous entries.

When the user clicks the check box saying they are done entering questions, it creates a file of the quiz.

now here is how it "messes up". if you enter in some code in step one, lets say <a href="http://www.google.com">Google</a>, it messes it up because first i dont want links and formating in this. and second, it is being echo'd and the quotes are closing the echo.

I quess i can use javascript if i must. i'm not too familiar with it, but i have worked with it before. but lets say someone doesnt have it enabled? do i use <noscript> to tell them they must enable it?

[drawmack]

http://www.php.net/strip_tags

does the page submit to php after each part? If so just prepare the text before you echo it. If not then use javascript and use the on_change method, then everytime they type a caracter test if it is < or " and if it is delete it right away and throw up an alert.