How to avoid echoing the line break symbol in htmlentities..?

[bugzy]

For some weird reason I needed to use htmlentities on my textarea because I'm having a conflict on retrieving images..

 

If I remove the htmlentities..

 

I get this line

 

<img src="/\"/shop/images/page_images/cheap-bridesmaid-dress-thumb.png\"" alt="\"\"" />

 

instead of this

 

<img src="/shop/images/page_images/cheap-bridesmaid-dress-thumb.png" alt="" />

 

 

When I use htmlentities I have no problem at all except for that, it's echoing out linebreak symbol..

 

like this

\r\n



\r\n



\r\n

 

 

 

Any idea how can I fix this guys?

[scootstah]

Use htmlspecialchars instead.

[bugzy]

Use htmlspecialchars instead.

 

scootahs tried it like this..

$page_content = me_mysql_prep(htmlspecialchars($_POST['page_content']));

 

 

But it's still echoing out the line break symbol

[scootstah]

So I just tested it, and I can't get line breaks to output with either function. I am guessing they are saved in the database as "\\r\\n", which means you probably have magic quotes on.

[DavidAM]

$page_content = me_mysql_prep(htmlspecialchars($_POST['page_content']));

 

Why are you calling me_mysql_prep to send data to the browser? Either that function is for preparing data to send to the database or it is woefully misnamed. You do not ... let me say it again ... you do not need or want to perform database escapes on page content. If you do, you end up displaying carriage-returns and stuff that you don't want to see.

[hakimserwa]

i tink he showed as the wrong query isnt the data supposed to be coming from the database?

[bugzy]

$page_content = me_mysql_prep(htmlspecialchars($_POST['page_content']));

 

Why are you calling me_mysql_prep to send data to the browser? Either that function is for preparing data to send to the database or it is woefully misnamed. You do not ... let me say it again ... you do not need or want to perform database escapes on page content. If you do, you end up displaying carriage-returns and stuff that you don't want to see.

 

me_mysql_prep is a function on where mysql_real_escape_string is located... I thought every users' input that will be sent to the database needed to be secured? 

[scootstah]

It does, but it's not used for displaying back to the user.

[bugzy]

It does, but it's not used for displaying back to the user.

 

scoostah so it needs to be separated?

 

Because I also uses $page_content to sent back data if the user failed the validation and if he go pass through the validation then it will also be the one to  be sent on the database..

[scootstah]

Escape it when it goes to the database. If you are displaying it back to the user, it doesn't need to be escaped.

 

You still need to be running htmlentities() or htmlspecialchars() for displaying though, to prevent XSS attacks.

[bugzy]

Escape it when it goes to the database. If you are displaying it back to the user, it doesn't need to be escaped.

 

You still need to be running htmlentities() or htmlspecialchars() for displaying though, to prevent XSS attacks.

 

Thanks scootstah and DavidAM. That was indeed the reason why I am getting those line breaks!

 

 

Thanks again