before you insert,
use
- text= if get_magic_quotes_gpc() then stripslashes($_POST['text'])
- text = mysql_real_escape_string(text)
- INSERT into mysql field
========
When pull it back from Database:
You can use:
- text = mysq result row['textarea']
- $output = htmlspecialchars('text');
- echo $output;
========================
not only will your text have a good format.
But it will be more secure, if you take it as a good rule to use:
[man]mysql_real_escape_string[/man]
This function is to prepare any String to have the correct and SAFE Format
for insert into a MySQL database Field
Study and read howto use those functions
Notice all those Examples from readers posted comments!
[man]get_magic_quotes_gpc[/man]
[man]stripslashes[/man]
[man]mysql_real_escape_string[/man]
[man]mysql_query[/man]
[man]htmlspecialchars[/man]
[man]echo[/man]
😉
why not be very basic,
even if you and I know several of these things more than well, since before
Back To Basics
... thinks halojoy 🙂