[RESOLVED] Storing HTML in MySQL

webdes03

Hello all!

I'm trying to store HTML code in MySQL, to then be rendered from the database as part of a website. The problem I'm having is that the HTML is not rendering when pulled from the database. Instead, the script is treating the entire MySQL field as text and displaying it. For example, instead of rendering "This is my text.", it is simply displaying "<b>This is my text</b>."

The content is stored in a 'text' field, and inputted using a HTMLArea-like WYSIWYG editor. I'm retreiving it in the following way...

// header.php
// this function retrives the data from MySQL and stores it in $string.
function retrieve_content($section){
  $query="SELECT * FROM tblContent WHERE section='$section'";
  $result=mysql_query($query);
  $row=mysql_fetch_array($result);

  $string = stripslashes(trim($row[content]));

  return $string;
}

// main.php
// print content
echo retrieve_content('home');

Does anyone have any suggestions? Am I just making some stupid mistake somewhere?- this has been driving me nuts!

Thanks!

thorpe

can you show us an example of what your html source code look like. ie, run this script in a browser, right click->view source. what do you see?

TobyRT

What script are you using to format the text in the <textarea>?

I've found TinyMCE quite useful.

Would "retrieve_content['home']" be the problem?

I'm not familiar with that one function. Whenever I do a plain echo of html stored in my db it comes out fine...

The HTML IS being stored inthe db isn't it?

webdes03

I'm using a HTMLArea type editor which I made... I'm using it commercially so wanted to have something original, as opposed to something licensed.

HTML is being stored in the database. Below is a copy/paste from phpMyAdmin:

<div align=\"center\"><font size=\"5\"><strong>
This be my text...<em><font color=\"#006666\">woohee</font>...<br /><br /><a href=\"http://yahoo.com\">WooT</a><br /></em></strong></font></div>

It is being displayed on the website like this:

<div align="center"><font size="5"><strong>
This be my text...<em><font color="#006666">woohee</font>...<br /><br /><a href="http://yahoo.com">WooT</a><br /></em></strong></font></div>

I'm using a "text" field in the database... should I use another type of field?

leatherback

Probably your html elements are transformed into ASCII chars?
Try using $string = htmlentities(stripslashes(trim($row[content])));

You should try to avoid the stripslashes. It indicates that you are adding slashes to the content twice. Better check before inserting the data whether you need to add slashes. THen you do not have to remove them afterwards.

function encode($text)  // Will add slashes to userinput
  {
  if (!get_magic_quotes_gpc()) 
     {
     $uittext = addslashes($text);
     }
  else 
     {
     $uittext = $text;
     }
  return $uittext;
  }

TobyRT

That looks fine to me - and I use text as the field type.

I thought TinyMCE was open source?

What happens if you simplify the query and just tell say echo $row['mytext']; ?

TobyRT

incidentally Leatherback, do you know anywhere where i can get an idiots guide to using add/stripslashes? I know they're important for security etc, but I just can't find a decent guide to them that speaks plain english and gives clear concise examples of how to use the syntax.

Event the book I bought only has about half a page on'em!

webdes03

I'm such an idiot... I was converting HTML entities to ASCII in another function of my script... took that out and its working now... that was in a different file and I just didn't think about it though!

Thanks for getting me on the right track!!

Have a great day guys.

leatherback

@ toby:

Idiots guide for addslashes.. not really. The main idea is that SQL queries also use quotes as delimeters of fields. So you'd have to make sure that these get slashed. However, many webservers do that already when you post data. So if you uses the if (!get_magic_quotes_gpc()) statement, you will know whether the server has already added slashes.
Subsequently, when the data is added to the database, the slashes which were placed in front of any character that needed it, are not there: They are only a sign to sql: Watch out! The next character is to be taken literal, and not interpreted! SO ne need to remove them.

TinyMCE is freeware