[SOLVED] Disabling HTML in INPUT and TEXTAREA

[tomcommathe]

Title says it all, I am hoping to disable all HTML tags in a form (eventually adding in BBC-Style codes for basic options like bold and images and the like)

 

Post Code:

<?
$username="username";
$password="password";
$database="database";

$name=$_POST['name'];
$email=$_POST['email'];
$subject=$_POST['subject'];
$date=$_POST['date'];
$time=$_POST['time'];
$news=$_POST['news']


mysql_connect(localhost,$username,$password);
@mysql_select_db($database) or die( "Unable to select database");

$query = 
$query = "INSERT INTO newsupdate VALUES ('','$name','$email','$subject','$date','$time','$news')";
mysql_query($query);

mysql_close();

header('Location:URL');

?>

 

The Form Code:

<div id="form">
<form action="updatenews.php" method="post">
Name: <input type="text" name="name"><br><br>
E-mail: <input type="text" name="email"><br><br>
Subject: <input type="text" name="subject"><br><br>
News Update:<br>
  <textarea name="news" rows="4" cols="26"  /></textarea> <br /><br>
  <input type="Submit" value="Submit News!">
<input type="hidden" name="date" value="<? echo date('F j, Y'); ?>" />
<input type="hidden" name="time" value="<? echo date('h:i'); ?>" /
</form>
</div>

 

Thanks for any help!

[gevans]

You can do this in your php code;

 

$foo = "<p>Some html<br />to get rid of</p>";

$bar = strip_tags($foo);

echo $bar; // Some htmlto get rid of

[tomcommathe]

Could I do it with the $_POST data. Like:

 

$news = $_POST['news'];

$bar = strip_tags($news);

echo $bar . $news;

[gevans]

Nearly, the last variable should be $bar not $news

 

$news = $_POST['news'];
$bar = strip_tags($news);
echo $bar;

[tomcommathe]

Wah wha wha....

 

Maybe I did something wrong, but I don't know...

This is a Paragraph that has become bold!

Warning: Cannot modify header information - headers already sent by (output started at /home/mijunkin/public_html/mopedstl/phpTest/newsUpdate/updatenews.php:14) in /home/mijunkin/public_html/mopedstl/phpTest/newsUpdate/updatenews.php on line 26

 

Updated Code (but putting an echo in there doesn't seem right since I am trying to write to MySQL Database. ::

<?
$username="username";
$password="pwd";
$database="database";
$bar = strip_tags($news);

$name=$_POST['name'];
$email=$_POST['email'];
$subject=$_POST['subject'];
$date=$_POST['date'];
$time=$_POST['time'];
$news=$_POST['news'];
$bar = strip_tags($news);
echo $bar;


mysql_connect(localhost,$username,$password);
@mysql_select_db($database) or die( "Unable to select database");

$query = 
$query = "INSERT INTO newsupdate VALUES ('','$name','$email','$subject','$date','$time','$news')";
mysql_query($query);

mysql_close();

header('Location:http://mopedstl.com/phpTest/newsUpdate/');

?>

[Philip]

You echo'd something before you put your header output

echo $bar;

...

header('Location:http://mopedstl.com/phpTest/newsUpdate/');

 

I would just comment out the header line, for now.

[tomcommathe]

Problem solved! What I ended up doing was...

 

<?
$username="user";
$password="pword";
$database="database";


$name=$_POST['name'];
$email=$_POST['email'];
$subject=$_POST['subject'];
$date=$_POST['date'];
$time=$_POST['time'];
$news=strip_tags($_POST['news']);

mysql_connect(localhost,$username,$password);
@mysql_select_db($database) or die( "Unable to select database");

$query = "INSERT INTO newsupdate VALUES ('','$name','$email','$subject','$date','$time','$news')";
mysql_query($query);

mysql_close();

header('Location:http://mopedstl.com/phpTest/newsUpdate/');

?>