HTML stored in form variable breaking page

[schwim]

Hi there guys,

I'm having a problem with a form submission. I'm creating an HTML sandbox where people can work on their templates and when done, save them to the database. Problem is, I can't seem to save the HTML to a hidden form element because it's breaking the rest of the page.

You can see the page in action here. Login is "test" and password is "password".

The HTML I am testing it with is here. Finally, you can view the code for input.php(the top page) and output.php(the bottom page).

The way it's supposed to work is you work on the HTML until you're satisfied, then Click "Save this template". The form submits to action=save and it allows you the ability to add the necessary data for submission. Clicking save should then enter the template into the database.

The problem is that with a template entered into the textarea, it makes the form(and surrounding table) disappear. I guess I need to do something to the code stored in the hidden variable before I store it. I have tried stripslashes and mysql_real_escape_string, but neither made a difference.

With simple HTML, the page works. When I enter more complex HTML, it causes the problem. It breaks during the printing of the form:

<div align='center'>
		<table width='100%' border='2' bgcolor='#ffffff'>
			<tr>
				<td>
				<form name='template_output' method='post' action='output.php?action=save'>
					<input type='hidden' name='code' value='<it begins the template HTML here>

I'd very much appreciate some help with this as I'm not sure how to go about getting around this roadblock.

thanks,
json

[dagon]

you want to use htmlentities() otherwise the submitted html will be 'run' by the browser breaking your form

[schwim]

The part at the bottom is supposed to be run by the browser. Are you saying that I need to convert it before entering it into the hidden element, and then reconvert it back into HTML to save it to the database? If so, how do I reconvert it?

[dagon]

As Mr manual says:

If you're wanting to decode instead (the reverse) you can use html_entity_decode().

[djjjozsi]

store the html in SESSION, then write into database with the changes if needed,
if you take that into a form (textarea, textfield,....), lets use htmlspecialchars()