Adding to Mysql db exactly

[PoorDoggie]

If someone puts (in a text box):

<a href="this.com">This this this</a> This this this "this this"

<b>This this this</b>
<h1>That</h1>

how do I have that add to a mysql database exactlly as is show there? (so that when it is got from the mysql database the HTML parses as HTML and the carriage returns show as carriage returns)?

Thanks
Tom

 

[user-7256]

$textarea_content = nl2br($textarea_content);

What that function is, nl2br, is "new line to break". Then, when you go to retrieve the value and IF it is put into a textbox (for example, editing a forum post, or something.) it will display the <br /> tags. You don't want this. Simple run a str_replace(); statement to replace all "<br />" with nothing: "".

Cheers,
-Matt

 

[Peter]

also remember to make it safe to inclue in a statement so someone can't just make their own, use something like mysql_real_escape_string()

 

[PoorDoggie]

Then, when you go to retrieve the value and IF it is put into a textbox (for example, editing a forum post, or something.) it will display the <br /> tags. You don't want this. Simple run a str_replace(); statement to replace all "<br />" with nothing: "".

So for each carriage return it will put in a <br />, but I need to remove any <br />'s put in first?

also remember to make it safe to inclue in a statement so someone can't just make their own, use something like mysql_real_escape_string()

I don't understand! Could you explain in lamens terms. I'm not as clever as I look! :lol:

Thanks
Tom

 

[Peter]

if you allow untrusted people (or people who do not know about programming) submit the form you can inadvertantly allow them to for example change information in your database or worse still delete tables or even the database itself.

If you use a function such as mysql_real_escape_string() it will make the text safe to use in a mysql database.

Regarding the <br> question. If someone enters the following

<a href="this.com">This this this</a> This this this "this this"

<b>This this this</b>
<h1>That</h1>

the processing script will actually receive

<a href="this.com">This this this</a> This this this "this this"\n\n<b>This this this</b>\n<h1>That</h1>

when running that through nl2br() it will bake it

This this this</a> This this this "this this"<br /><br /><b>This this this</b><br /><h1>That</h1>

If a user puts in their own <br> or <br /> you will have too many line breaks, the ones the user entered plus 1 for each new line.

 

[PoorDoggie]

if you allow untrusted people (or people who do not know about programming) submit the form you can inadvertantly allow them to for example change information in ...QUOTE]
thanks for the help!
Tom

Hey, what if I wanted to remove all HTML? Would I have to do str_replace for all HTML options, or is there an easier way?

 

[RJ]

To remove HTML from input:

$string = strip_tags($string)

See http://us2.php.net/manual/en/function.strip-tags.php

For your original question, how about if you provide a sample script that is attmempting what you want, and we can try to answer more specific questions.

If someone enters your sample input into a text box, it shuold be very easy for you to save it exactly as entered into MySQL. Just use the addslashes php funciton to escape any special characters before saving it to your db.

 

[Peter]

Just use the addslashes php funciton to escape any special characters before saving it to your db.

That is not necessarily a good idea if register globals is turned on on his server. He would basically be adding slashes to something that already has addslashes carried out on it, so when he pulls it back out and displays it the slashes will be there.

Regarding the strip_tags() function this may be ideal for the purpose you want it for as you can specifically list tags you wish to allow.

 

[Don]

That is not necessarily a good idea if register globals is turned on on his server. He would basically be adding slashes to something that already has addslashes carried out on it, so when he pulls it back out and displays it the slashes will be there.

They won't be there if he runs stripslashes on the recieving end.

 

[Peter]

it would be better if he checked wether register globals was active before doing anything to the string then act accordingly.

if he stripslashes on something that has not ran through register globals it could have undesireable effects.