bugzy Posted August 2, 2012 Share Posted August 2, 2012 For some weird reason I needed to use htmlentities on my textarea because I'm having a conflict on retrieving images.. If I remove the htmlentities.. I get this line <img src="/\"/shop/images/page_images/cheap-bridesmaid-dress-thumb.png\"" alt="\"\"" /> instead of this <img src="/shop/images/page_images/cheap-bridesmaid-dress-thumb.png" alt="" /> When I use htmlentities I have no problem at all except for that, it's echoing out linebreak symbol.. like this \r\n \r\n \r\n Any idea how can I fix this guys? Quote Link to comment https://forums.phpfreaks.com/topic/266618-how-to-avoid-echoing-the-line-break-symbol-in-htmlentities/ Share on other sites More sharing options...
scootstah Posted August 2, 2012 Share Posted August 2, 2012 Use htmlspecialchars instead. Quote Link to comment https://forums.phpfreaks.com/topic/266618-how-to-avoid-echoing-the-line-break-symbol-in-htmlentities/#findComment-1366470 Share on other sites More sharing options...
bugzy Posted August 2, 2012 Author Share Posted August 2, 2012 Use htmlspecialchars instead. scootahs tried it like this.. $page_content = me_mysql_prep(htmlspecialchars($_POST['page_content'])); But it's still echoing out the line break symbol Quote Link to comment https://forums.phpfreaks.com/topic/266618-how-to-avoid-echoing-the-line-break-symbol-in-htmlentities/#findComment-1366472 Share on other sites More sharing options...
scootstah Posted August 3, 2012 Share Posted August 3, 2012 So I just tested it, and I can't get line breaks to output with either function. I am guessing they are saved in the database as "\\r\\n", which means you probably have magic quotes on. Quote Link to comment https://forums.phpfreaks.com/topic/266618-how-to-avoid-echoing-the-line-break-symbol-in-htmlentities/#findComment-1366491 Share on other sites More sharing options...
DavidAM Posted August 4, 2012 Share Posted August 4, 2012 $page_content = me_mysql_prep(htmlspecialchars($_POST['page_content'])); Why are you calling me_mysql_prep to send data to the browser? Either that function is for preparing data to send to the database or it is woefully misnamed. You do not ... let me say it again ... you do not need or want to perform database escapes on page content. If you do, you end up displaying carriage-returns and stuff that you don't want to see. Quote Link to comment https://forums.phpfreaks.com/topic/266618-how-to-avoid-echoing-the-line-break-symbol-in-htmlentities/#findComment-1366735 Share on other sites More sharing options...
hakimserwa Posted August 4, 2012 Share Posted August 4, 2012 i tink he showed as the wrong query isnt the data supposed to be coming from the database? Quote Link to comment https://forums.phpfreaks.com/topic/266618-how-to-avoid-echoing-the-line-break-symbol-in-htmlentities/#findComment-1366737 Share on other sites More sharing options...
bugzy Posted August 5, 2012 Author Share Posted August 5, 2012 $page_content = me_mysql_prep(htmlspecialchars($_POST['page_content'])); Why are you calling me_mysql_prep to send data to the browser? Either that function is for preparing data to send to the database or it is woefully misnamed. You do not ... let me say it again ... you do not need or want to perform database escapes on page content. If you do, you end up displaying carriage-returns and stuff that you don't want to see. me_mysql_prep is a function on where mysql_real_escape_string is located... I thought every users' input that will be sent to the database needed to be secured? Quote Link to comment https://forums.phpfreaks.com/topic/266618-how-to-avoid-echoing-the-line-break-symbol-in-htmlentities/#findComment-1366936 Share on other sites More sharing options...
scootstah Posted August 5, 2012 Share Posted August 5, 2012 It does, but it's not used for displaying back to the user. Quote Link to comment https://forums.phpfreaks.com/topic/266618-how-to-avoid-echoing-the-line-break-symbol-in-htmlentities/#findComment-1366946 Share on other sites More sharing options...
bugzy Posted August 5, 2012 Author Share Posted August 5, 2012 It does, but it's not used for displaying back to the user. scoostah so it needs to be separated? Because I also uses $page_content to sent back data if the user failed the validation and if he go pass through the validation then it will also be the one to be sent on the database.. Quote Link to comment https://forums.phpfreaks.com/topic/266618-how-to-avoid-echoing-the-line-break-symbol-in-htmlentities/#findComment-1366987 Share on other sites More sharing options...
scootstah Posted August 5, 2012 Share Posted August 5, 2012 Escape it when it goes to the database. If you are displaying it back to the user, it doesn't need to be escaped. You still need to be running htmlentities() or htmlspecialchars() for displaying though, to prevent XSS attacks. Quote Link to comment https://forums.phpfreaks.com/topic/266618-how-to-avoid-echoing-the-line-break-symbol-in-htmlentities/#findComment-1367005 Share on other sites More sharing options...
bugzy Posted August 5, 2012 Author Share Posted August 5, 2012 Escape it when it goes to the database. If you are displaying it back to the user, it doesn't need to be escaped. You still need to be running htmlentities() or htmlspecialchars() for displaying though, to prevent XSS attacks. Thanks scootstah and DavidAM. That was indeed the reason why I am getting those line breaks! Thanks again Quote Link to comment https://forums.phpfreaks.com/topic/266618-how-to-avoid-echoing-the-line-break-symbol-in-htmlentities/#findComment-1367016 Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.