Htmlentities

[3raser]

Highly annoying.

 

Data is submitted to the database wrapped in the nl2br() function. When viewing the data, htmlentities is used to keep away any XSS or HTML vulnerabilities. But all new lines show up as <br /> instead of a new line. I even made a function to stop them from happening:

 

public function br2nl($string)
    {
        return str_replace('<br />', "\n", $string);
    }

 

Which doesn't work. Any advice?

[btherl]

Try printing out your string before br2nl() and after br2nl(), to see what is going wrong.

[3raser]

Try printing out your string before br2nl() and after br2nl(), to see what is going wrong.

 

No differences from what I can tell. It remains:

 

fdsfdsfdsfdsf<br /> <br /> <br /> <br /> <br /> <br /> <br /> fdsfdsfdsfds<br /> <br /> <br /> <br /> <br /> <br /> dfdsfdsfdsf<br /> <br /> <b>wut</b>

[btherl]

Can you post a short script demonstrating that it doesn't work?  Something like this:

 

<?php
$str = "<br />";
function br2nl($string)
    {
        return str_replace('<br />', "\n", $string);
    }
print "Before: " . urlencode($str) . "\n";
$str = br2nl($str);
print "After: " . urlencode($str) . "\n";
?>

 

The urlencode() is there so you can see any hidden characters.

[3raser]

Can you post a short script demonstrating that it doesn't work?  Something like this:

 

<?php
$str = "<br />";
function br2nl($string)
    {
        return str_replace('<br />', "\n", $string);
    }
print "Before: " . urlencode($str) . "\n";
$str = br2nl($str);
print "After: " . urlencode($str) . "\n";
?>

 

The urlencode() is there so you can see any hidden characters.

 

Using your test:

 

Before: %3Cbr+%2F%3E After: %0A

 

Like I said, when using the br2nl function - nothing seems to change. The <br /> stays the same.

 

<?php
require('../structure/base.php');
$base = new base();

if(!isset($_POST['derp']))
{
    ?>

<form action="test.php" method="POST">
<textarea cols="55" rows="30" name="derp"></textarea><br/><input type="submit" value="Derp"> 
</form>

    <?php
}
else
{
    $content = nl2br($_POST['derp']);
    
    echo $base->br2nl(htmlentities($content)).'<br/><hr><br/>'.$content;
}

?>

[kicken]

By running it through htmlentities you are converting your <br /> tags to <br /> so that is what you need to search for and replace.

 

[3raser]

By running it through htmlentities you are converting your <br /> tags to <br /> so that is what you need to search for and replace.

 

public function br2nl($string)
    {
        return str_replace('<br />', "\n", $string);
    }

 

Eh, gets rid of the <br /> - But no new lines. I'm assuming I need to use something other than \n?

[kicken]

You need to use <br> if you want a new line in HTML.

 

return str_replace('<br />', '<br />', $string);

[3raser]

You need to use <br> if you want a new line in HTML.

 

return str_replace('<br />', '<br />', $string);

 

Haha, thank you.