Retrieve Text Formatting

Dysan

Hi, I have a form that puts data inside a database. How come when I entered information on new lines within the "Description" textbox, the data saved does not include the new line?

e.g.

Today is Wednesday.

Tomorrow is Thursday

gets stored as

Today is Wednesday.Tomorrow is Thursday

How do I restore the new lines/paragraphs?

<html>
<body>

<form action="2.php" method="post">
Title: <input type="text" name="title" />
Description: 
  <textarea name="description"></textarea>
<input type="submit" />
</form>

</body>
</html>

mysql_select_db("database", $con);

$sql="INSERT INTO jobs (title, description)
VALUES
('$_POST[title]','$_POST[description]')";

if (!mysql_query($sql,$con))
{
  die('Error: ' . mysql_error());
}
echo "1 record added";

mysql_close($con)
?>

Kudose

You need [man]nl2br[/man] to convert the character line breaks into HTML breaks.

Dysan

How do I apply that to my form, so it includes the lines breaks within the Description text box? 🙂

Kudose

Well, first of all

$sql="INSERT INTO jobs (title, description)
VALUES
('$_POST[title]','$_POST[description]')";

Leaves you open to SQL injection attacks.

To answer your question though, you would do something like:

$sql="INSERT INTO jobs (title, description)
VALUES
('$_POST[title]','".nl2br($_POST[description])."')";

Remember that you will want to escape or sanitize any data you are inserting into the database. Always assume someone is going to try to break your site.

edit

Forgot closing )

Dysan

OK Cheers 🙂

Warmaster

Kudose,

Could you explain how that leaves the code open to SQL injection attacks and show a better alternative please? Thanks, I am just curious froma newbie POV 😉

Warmaster

NogDog

I'd recommend that you apply the nl2br() only when actualy outputting the text in [X]HTML, rather than injecting <br /> tags into the text within the database. This way, the original data remains unchanged and appropriate for any use, not just HTML output.

@: See the [man]mysql_real_escape_string/man function and this cartoon.

Warmaster

So, according to mysql_real_escape_string() then this is what the code should look like to offer better security from SQL injections:

$sql="INSERT INTO jobs (title, description)
VALUES
('$_POST[title]','".nl2br($_POST[description])."')";

mysql_real_escape_string($title, mysql_connect variable here),
mysql_real_escape_string($description, mysql_connect variable here),

Thanks for the insight,

Warmaster

NogDog

$sql = sprintf(
   "INSERT INTO jobs (`title`, `description`) VALUES('%s', '%s')",
   mysql_real_escape_string($_POST['title']),
   mysql_real_escape_string($_POST['description'])
);

This assumes you are using the mysql interface. For other interfaces you would use the applicable escaping mechanism, or possibly use bound input parameters if available, such as with PDO or mysqli.

Warmaster

Thanks for explaining that for me NogDog!

Warmaster