Ugly message..

sum

Dear All,

I just started to learn php a month ago. I've managed to create page that allow user to send feedback/comment/message. it's simple, there is a text area that user fill in the message.
However, when i try to display the message, it doesn't look nice. it's like all the messages is put into one line, without any paragraph.
I'd really appreciate for any suggestion and advice...

below is the script :

<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<title>Untitled Document</title>
</head>

<body>
<p>Input your message:</p>
<form id="form1" name="form1" method="post" action="<? echo $_SERVER['PHP_SELF'];?>">
<p>
<textarea name="message" cols="50" rows="5" id="message"></textarea>
</p>
<p>
<input type="submit" name="Submit" value="Preview" />
</p>
</form>

<p>Your Message: <? echo $_POST['message'];?></p>

</body>

</html>

Fox1337

Simple enough, just use nl2br(). This will convert the new lines to <br/> tags so you can display it on your webpage and have the line breaks in tact.

Simple as this:

<? echo nl2br($_POST['message']);?>

sum

thx a lot, Fox1337
🙂

TenFold

but DO NOT put that on your site, for the user could simply submit some php or html script to takeover your site, heres what you should have for the php part...

<?php echo htmlentities(nl2br($_POST[message])); ?>

that way, it wont actually echo out what the user inputs, so you will be safe 🙂

sum

thx for the ur advice,Tenfold...
🙂

sum

I'm aware that the code provides security. but the tags becomes visible and it makes the message looks bad. any solution?

Weedpacket

[man]strip_tags[/man]

sum

how about this:

$msg=nl2br(htmlentities( $_POST[message] ) );
echo $msg;

is it safe?

Fox1337

sum wrote:
how about this:
$msg=nl2br(htmlentities( $_POST[message] ) );
echo $msg;
is it safe?

You can just use strip_tags() as Weedpacket said, if you don't like the look of having the tags visable. This will strip all HTML tags from the string so they are no longer there. htmlentities() simply converts the characters to ASCII format so they aren't inline rendered by your browser, just displayed as output.

The only thing you really have to worry about is the <script> tag. This can be used in combination with an external PHP page to steal any cookies on that domain. Which, again, isn't really a matter unless you have an admin panel or forum or something where cookies would be an issue.

  

$msg=strip_tags(htmlentities($_POST[message]));
echo $msg;

sum

thx again,Fox, for the explanation.....may be i'll use the strip_tags()...
by the way, another problem occurs when I try to display the message in a table.
for normal message the table doesn't have any problem at all. but when the user try to input like this : a string with size more than table width(or column width) as the table/column will automatically resize.
i know this is not a big matter as no one will send message like that, but just in case it happens.....
do you have any idea to solve this?