HTML code in post rejecting..

mistyd

I have people copying and pasting into a textarea field. I could not figure out what in a particular clump of text was being rejected by php. I copied and pasted it into Dreamweaver, and in the code discovered 3 of the dashes were showing as "–"

I removed those 3 dashes and resubmitted the form and it went through fine.

I cannot figure out how to prevent this from happening. I have tried html_entity() and html_entity_decode() and they didn't work.

Any ideas?

NogDog

Not sure I understand: is the text coming in from the form as "–" and you want to convert that to its single character, or the inverse?

mistyd

It's hard to explain. The person who submitted the form said she copied/pasted it in. I could not figure out where the problem was happening, so I kept deleting one line of text at a time. Once I got up to above where the offenders were, it went through. Looking at it in the form, it looked fine.

But when I copied it all into Dreamweaver, then viewed the code, most of the dashes shown were in the code as regular dashes, but 3 of them showed as "–". I took those three out and repasted the code into the form and it worked.

So, I guess I'm not sure WHAT I am trying to do! :-)

NogDog

OK, I think the problem is that "–" is not standardly supported as a HTML character entity. The quick-and-dirty solution (as opposed to analyzing all the code and such to figure out how they get in there) would be to create a simple filter function for that:

function filterNdash($text)
{
   return(str_replace('&ndash;', '-', $text));
}

Then wherever you output any such user-supplied data, just run it through that function:

echo filterNdash($text_from_the_user);

mistyd

Darn .. that didn't work either! I did some searching for "endash" online, and found the following:

"A: Word 6.0 added a new feature called Smart Quotes, which are actual open-quotation and close-quotation marks instead of "straight" quotes. Unfortunately, WinHelp doesn't have this feature. The problem is that the RTF codes emitted by Word 6.0 aren't the normal ASCII codes for quotation marks. (And the quotes aren't the only items that Word has "smartened": the bullet, emdash, and endash are no longer "characters"--that is, ASCII codes but are now graphics.)"

I am pretty sure she copied that information from Word. Aside from telling people not to copy/paste from Word into the form (not very customer friendly), is there anything that will prevent these "graphics" from trying to come through on the form?

Weedpacket

I'd like to see this PHP code that is "rejecting" – and find out what "rejecting" means.

NogDog

You could try adding an accept-charset attribute to your form tag, e.g.:

<form action="some_page.php" method="post" [color=red]accept-charset="ISO-8859-1"[/color]>

You could also look for the specific character and replace it with a hyphen:

$text = str_replace(chr(150), '-', $text);

mistyd

The form is at http://www2.otc.fsu.edu/Forms/TSR/order_form.php. Here's the first part of the processing page. When I say rejecting, I mean the page goes to the email error page, and a record is not created in the database (FileMaker Pro). When I remove the offending dashes from the "details of work" field, it works as it should. Also, I could copy and paste the information (with the dashes) into a Filemaker record after it was created without a problem, so I don't think it's a database issue.

<?php
require_once('FX.php');
require_once('server_data.php');

if ($_POST['WebValid'] == "Yes") {

function convert_smart_quotes($string)
{
$search = array(chr(145),
chr(146),
chr(147),
chr(148),
chr(150),
chr(151),
"#",
";",
"[",
"]",
"{",
"}",
"<",
">",
"=",
"URL=http://");
$replace = array("'",
"'",
'"',
'"',
" ",
" ",
"no.",
",",
"",
"",
"",
"",
"",
"equals",
"");
return str_replace($search, $replace, $string); }

$newRecordArray = array('Contact_Name' => stripslashes($POST['Contact_Name']), 'Contact_Phone' => $POST['Contact_Phone'],'Contact_Email' => $POST['Contact_Email'],'Contact_Room' => $POST['Contact_Room'],'Contact_Bldg_Unlisted' => stripslashes($POST['Contact_Bldg_Unlisted']),'Department_Unlisted' => stripslashes($POST['Department_Unlisted']),'Budget_Auth_Signature' => stripslashes($POST['Budget_Auth_Signature']),'Budget_Phone' => $POST['Budget_Phone'],'Budget_Email_Address' => $POST['Budget_Email_Address'],'Budget_Rec_DeptID' => $POST['Budget_Rec_DeptID'],'Budget_Rec_FundCode' => $POST['Budget_Rec_FundCode'],'Budget_Rec_Project' => $POST['Budget_Rec_Project'],'Budget_NR_DeptID' => $POST['Budget_NR_DeptID'],'Budget_NR_FundCode' => $POST['Budget_NR_FundCode'],'Budget_NR_Project' => $POST['Budget_NR_Project'],'Service_Bldg_Unlisted' => stripslashes($POST['Service_Bldg_Unlisted']),'Service_Location_Rm' => $POST['Service_Location_Rm'],'Customer_Description' => stripslashes($POST['Customer_Description']),'WebValid' => $_POST['WebValid']);

// configure a connection to FileMaker Server Advanced
$ordersQuery = new FX(FM_IP, FM_PORT, FM_VERSION);
// set database and layout information
$ordersQuery->SetDBData('Webtest_Forms.fp7', 'Orders_FormView');
// set database username and password
$ordersQuery->SetDBUserPass(FM_USERNAME, FM_PASSWORD);
// retrieve all records in this database available to the current user
// add parameter array for new record
$ordersQuery->AddDBParamArray($newRecordArray);
// Add pararameters for the checkboxes. This allows some to be not checked without an error.
$checkBoxes = array('BasicSvc_Features','Instrument','Number_800','Calling_Card','COS','Auth_Code','Voice Mail','VM_Passcode_Reset','Meet_Me','Cellular_Service','SCV','Video_Conference','Networking','DSL','Cable_Internet','Access_System','Budget_Info_Change','Information_Change','Wiring', 'Estimate');

foreach($checkBoxes as $checkBox) {
if(isset($POST[$checkBox])) {
$ordersQuery->AddDBParam($checkBox, $POST[$checkBox]);
}
}

// Add pararameters for the drop-down lists. This allows some to be empty without an error.
$dropBoxes = array('Contact_Bldg','Department_Name','Service_Location_Bldg','ChartField_1','ChartField_2','ChartField_3');
foreach($dropBoxes as $dropBox) {
if(isset($POST[$dropBox])) {
$ordersQuery->AddDBParam($dropBox, $POST[$dropBox]);
}
}

$orders = $ordersQuery->DoFXAction(FX_ACTION_NEW);
$orders = convert_smart_quotes($orders);
foreach ($orders as $order);
if (isset($POST['Cellular_Service'])) // Redirect browser if cell order
{
$SESSION['ON'] = $order['Order_Number'];
header("Location: http://www2.otc.fsu.edu/Forms/Cell/cellreg.php?Order_Number=".$_SESSION['ON']);
} else {

//Begin HTML email confirmation
... there's more that won't fit here. If you need to see more, let me know.

mistyd

NogDog, I tried adding the accept-charset="ISO-8859-1", and it didn't work either. I appreciate all you suggestions though ... they are things I wouldn't have thought of.