htmlentities problem

iCOATES

I've cobbled together this form where I have a checkbox and textbox. when the checkbox is ticked some text is displayed. In that text there is the text from the textbox.

The problem is the text i enter has html tags etc. and when the output is generated it italicizes the text (for example). I have tags in the sometext that i dont want to affect. I just want to effect the ' . $_POST['num'] . ' bit. Any ideas?

<?PHP
$ch1 = ' ';
$ch2 = ' ';
$ch3 = ' ';

if (isset($POST['Submit1'])) {
if (isset($POST['ch1'])) {
$ch1 = $POST['ch1'];
if ($ch1 = 'net')
{
$ch1 = 'sometext' . $POST['num'] . 'some more text';
}
}

etc (for different checkboxes)

}
?>

<?PHP print $ch1; ?>

dagon

since its hard codded text why don't you just remove the html?

iCOATES

i want the output to appear in a certain way so i have line breaks (I suppose i could remove them if forced to). The form html is on a different page. i prob need htmlentities() but i've tried fitting it in with no luck

dagon

so you want to remove only some of the html since you want ?

iCOATES

yeah the output of the textbox is ' . $_POST['num'] . ' . it's just this that i want to convert < to <

dagon

$ch1 = 'sometext' . htmlentities($_POST['num']) . 'some more text';

iCOATES

i've tried that, no luck unfortunately😕

dagon

it does what it says on the tin. I'm still confused as what you actully want to achieve, I'm sure some one else will probably come along who understands what you are after.

iCOATES

Have a look at the form

http://iancoates.uuuq.com/development/a.php

the details box needs to contain tags , etc, that will be copy/paste from something else.

johanafm

All output on the page that handles form submit is put through htmlentities, except for what comes from the details input. I've no idea why you're using htmlentities on the rest of your page, but at least the details box does indeed allow html code.

However, you are open to XSS attacks. If you really need to allow user's to post html code, you will have to create a white list filter. It might be easier to create tags in bbcode style:
[sub] [/sub], [sup] [/sup] etc...
when the server receives post data:
1. replace all < and > with < and >
2. replace [sub] with etc

iCOATES

CRACKED IT!

just added $det = $_POST["det"]; at the top of the script, simples

Thanks for the help

Ian

johanafm

If you are actually using the code serving the page you posted above (http://iancoates.uuuq.com/development/a.php), you really need to deal with filtering.

dagon

The html of that page is so screwed up i wouldn't assume the form is even going to work