Safe form return

Fooglmog

Right now, I'm designing a forum. I'm nearly done, but have one last bug I can't seem to nail down.

When users submit a post, it goes through some validation. If it fails, the post doesn't get submitted but instead gets put back into the text-box so they don't lose what they wrote and they get an error message saying what to fix (eg. That they need a title).

However, when it gets returned, I can't return it raw -- because if they have a </textarea> in their post it will break the page. But, if I put it through htmlentities or something similar, I get slashes all through their post which can put them over the character limit.

Can anyone help me find a solution to this?

traq

so, you're allowing them to submit HTML in their posts?

[man]htmlentities/man doesn't escape by adding slashes - as its name suggests, it converts special characters to their html entity equivalents (e.g., < becomes < ).

If slashes are turning up in your output, they're probably coming from somewhere else - my first thought would be [font=monospace]magic_quotes_gpc[/font].

Fooglmog

Oh, of course. That makes sense.

I think I'll just do the validation prior to submission with javascript... rather than after with php. Ought to be a ton better for bandwidth.

Weedpacket

Fooglmog wrote:
I think I'll just do the validation prior to submission with javascript... rather than after with php. Ought to be a ton better for bandwidth.

JavaScript can be bypassed, so you'll still have to do it with PHP anyway.

Fooglmog

Right... but if they're intentionally bypassing the javascript, I don't have to be nice and return their post text to them.

traq

...but you will, unless you validate it again in order to discover that they bypassed the js validation.

skipping server-side validation is a bad idea, for so many more reasons than user inconvenience.

[edit]
(and you might still have the problem of the extra slashes)

Fooglmog

No, no. I wasn't saying that I'd skip the server side validation.

The server side validation stays. But since the only way to fail the server-side validation is to bypass the user side validation -- I don't need to return their original post text to them if they fail server side. See?

I don't mind causing inconvenience to those who bypass the user side validation.

Weedpacket

Fooglmog wrote:
See?

No, because you said

I think I'll just do the validation prior to submission with javascript... rather than after with php. [Emphasis mine]

So you said you would skip the server-side validation.

I don't need to return their original post text to them if they fail server side.

But what's stopping you from doing so, apart from choosing to potentially inconvenience people who may have a perfectly good reason for not running JavaScript?

Fooglmog

Point taken.

This is why I come here 🙂