Stripping characters from textarea field

tpclarke2

I have a textarea field on a form for internal staff. I have had to tell them to use letters and numbers only because special characters cause PHP to stop parsing. They continue to us things like & and ; and \

Is there a function to look for special characters in the $_POST array and escape them out?

Thanks.

laserlight

Err... it looks like you did not properly sanitise your data, either on entry to the database, or when displaying it, or both. It is not that "special characters cause PHP to stop parsing", but that these characters may alter the meaning of say, some SQL statement, or more likely in your case, cause the web browser to interpret text values as HTML code.

So, use the appropriate escaping mechanism for your SQL queries, and then use [man]htmlspecialchars/man where appropriate for displaying text.

tpclarke2

Thanks for the reply. I guess I should've mentioned that I am taking this info from $_POST and then sending it via the mail() function, not for use in an SQL query. The problem is when they use some special characters, their message is cut off at the point of the special character and thus stops the parsing process and sends on an incomplete message.

bradgrafelman

Again, PHP doesn't "stop parsing" or anything like that just because someone POST's a certain character.

Do a [man]print_r/man on the $_POST array to verify that the information is being received as it was entered. What does the output look like when you submit one of these "special characters" ?

tpclarke2

Thanks for the input and help. It's a single quote that causes everything to stop.

Submitted:

test; test() test& test" test,test/ test\ test$ $test test' 'test

and got back:

test; test() test& test" test,test/ test\ test$ $test test

Is there a function that will escape the single quote?

bradgrafelman

How did you display that info? Try doing a [man]var_dump/man on $_POST and post the exact output here.

tpclarke2

var_dump shows the entire submitted array, single quotes and all:

array(2) { ["message"]=> string(65) "test; test() test& test" test,test/ test\ test$ $test test' 'test" ["submit"]=> string(6) "submit" }

bradgrafelman

Ok, so then how are you trying to display the information where it seems to get cut off?

tpclarke2

using the mail() function, after supplying with the required stuff (recipient, from, etc) I am then going through the inputted items from the form as follows:

ksort($POST);
foreach ($POST as $key => $value){
if ($key != "submit"){
if ($key == "Zcomments") {$message .= "Comments|Notes: $value\n";}
else {message .= "$value\t$key\n";}
}
}

Then some other confirmation display stuff. Zcomments is the textarea field from the form.