[RESOLVED] htmlspecialchars() displaying html tags

jdc44

Greetings all, it's been a while since I've stopped in...

I have a database field (text) that users can populate via an admin form. they can enter html tags in the text for markup when the text is displayed on a web page. I've discovered a problem. I go to the page where the text is displayed and I'm seeing the html markup tags in the text. I can see the actual tags in the text, i.e: <i>foo</i>. They are not being hidden by the browser and the text inside the tags is not italicized.

I'm using:
print "<p>".htmlspecialchars($rowData['BIO'])."</p>";

when I print the db value out without using the htmlspecialchars(), everything looks as I would expect. No tags showing and the appropriate text is italics.

Anyone care to venture a guess as what is causing this?

Thanks for the help.
jdc44

laserlight

htmlspecialchars() is doing its job: changing < to < and < to > so that HTML tags are not parsed as HTML tags. In this special case, you just have to trust the user and not use htmlspecialchars(), at the risk of allowing cross site scripting if there is a malicious user.

jdc44

Thanks for the reply. I guess I did not realize that htmlspecialchars() was preventing "HTML tags from being parsed as HTML tags".

"...so that HTML tags are not parsed as HTML tags."

I guess I thought that a < would be turned back into a < and a > into a >.

Thanks again!

laserlight

You're welcome 🙂
Remember to mark this thread as resolved (if it is) using the thread tools.

jdc44

I'm happy, Thanks again for the help.

Cheers!