[RESOLVED] remove html in <textarea>

phpjaco

hello

is this possible, want to display text inside a form textarea that has been formatted with html but display the text without the tags.

so in other words I want the break spaces to display rather than showing

to explain this better you use nl2br($_POST['some_text'] and now want to display it without all the html tags? how do i do this. But also dont want to lose the current formatting.

is this possible?

Thanks

thorpe

nl2br() adds tags after new lines, doesn't replace them, so it should be safe to just strip the html out.

[man]strip_tags[/man]

phpjaco

im using ereg_replace("(\n\r)+, ,$some_text);

or rather something similiar, would this still be save to use this?

thorpe

Nope. Your code actually removes the newlines. So, if you strip the html out you will loose your formatting.

You really should avoid storing html in your database, and just use nl2br() when you need to display the data.

phpjaco

so in future should i rather, before writting my text rather use:

$final_text = nl2br($_POST['text'];

rather than regular expressions.?

and when i write to the db use INSERT blah blah (text) VALUES ("$final_text");?

also when displaying the text for editing purposes in textarea's use strip_tags($row['text'];

but of course no need to do this in normal html, the layout will be present in the db?

would this be the correct way to handle paragraph spacing?

is there anything i missed here?

the reason i used ereg_replace for the past two years or so is that pdf's mess up the format pretty badly when you paste it in a textarea.

thorpe

Youve got that all back the front. You should try to avoid storing html in the database. Leave it as it is, and do any conversions you need to do as you display it.

phpjaco

so do i just write the POST information straight into the db. and then use nl2br to display it for example in my html <? echo nl2br($row['text']; ?>

Weedpacket

nl2br, htmlspecialchars, .... all the usual stuff you need to do to plain text to turn it into HTML.

phpjaco

have tested it and seems to work, i now use nl2br to display the text in a browser and just wirte it in normally into the db.

im just wondering how does php know there are spaces in there in the first place when you write to the database? As from the POST varaible?

Weedpacket

phpjaco wrote:
im just wondering how does php know there are spaces in there in the first place when you write to the database? As from the POST varaible?

😕 The same way it knows there are 'a's, 'b's, and 'c's ... they're characters in the string

phpjaco

will do my text insert into the db like this from now.

thanks for all the help.

phpjaco

when adding information to the database it was said that no html should be included, does this also include the sinlge and double quotes and apostrophes etc?

so in other words is get_magic_quotes is that not enough aslready? Do you need to addslashes AND convert all characters to htmlspecialchars? Is this not overkill?
and what are the differences between urlencode and htmlspecialchars? I currently use urlencode (probably cause I know the decode is urldecode and not sure how to decode htmlspecialchars)

thank in advance

Weedpacket

No, apostrophes and quotes are not HTML. They're apostrophes and quotes. But they need to be escaped when they appear in attribute values, because HTML uses them to delimit attribute values.
get_magic_quotes does nothing about HTML (and deserves to die anyway because it causes more problems than it fixes.)
Compare [man]urlencode[/man] and [man]htmlspecialchars[/man]. Try them out and see what they do.

phpjaco

if get_magic_quotes suck what should then be used to escape quotes and apostraphes, most isp's these days have it turned on anyway.

they reason I ask about the quotes etc. is that new lines, apostraphes and double quotes keep breaking my code ,how do i prevent this from affecting my php code?

for example:

malicious input 1 : this's' is some "" copy' " " '" ' ''

especially the "" keep breaking most of my codes.

another example where this would create an error: '<img src="blah blah" alt="View[$row[name]">

If $row['name'] has any apostraphes in this would create an unterminated string error? how do i solve this?

do i just need to beef up on urlencode, htmlspecialchars, magic quotes and what else?