HTML in a form field

guigrrl

I'm having an issue.

I have a page, where the user enters data. I want the user to be able to enter simple HTML tags ( etc.). I also need to handle apostrophies and quotes. This data is collected and sent to a database.

Now, after the user enters the data (and it is sent to the database), I want the output page to display the data entered with the HTML tags applied. Such as:

Input: i'm "inputting" my entered data
Output: i'm "inputting" my entered data

I've looked up htmlentities() and htmlspecialchars() but I am missing something.

Help is REALLY appreciated. Thank you!

Lisa

Vbabiy

in put that infromation in to the database using mysql_escape_string() and then when you display it you should be fine..

guigrrl

So, I need to check and add every character that may be entered?

Houdini

Did you read the link to mysql_escape_string()?

guigrrl

Yes, but I'm just still a bit new at this and am a little confused. I'll figure it out. Thanks 🙂

guigrrl

Hmm....I've tried:

(when they hit "submit"
// set the new content

if ($updateMainContent == "SUBMIT"){
$updateMainContent = mysql_escape_string($mainContent);

$result = mysql_query("UPDATE products SET mainContent = '$mainContent';");

}

and still no luck...any clues?

madwormer2

You're applying the mysql_escape_string and putting it in $updateMainContent and then still using $mainContent in the sql string.

Just change the sql string to use the new variable.

guigrrl

well that was silly of me -- but now when i put in:

testing
123

the output is:

testing\r\n\r\n123

i'm sure this must be something much more complicated --

napper

Just wondering if you are running the following anywhere:

$GET = array_map('strip_tags',$GET);
or
$POST = array_map('strip_tags',$POST);

as these will REMOVE HTML from your string.

Now as to why it is outputting it in a HTML format. If you are printing it to the browser (and not a text box), then the browser (IE, FireFox) thinks it is regular HTML and will apply those HTML tags to your text as if it was meant to be part of your page. Have it print to a text box, or view source on your page to see how it is ouputting.