[SOLVED] help with HTML form input end escaping

[arumdevil]

Hi all,

 

New to PHP and learning quickish but still a lot to learn! Here's my problem:

 

I have a HTML form with a text area - the data gathered by the text area is stored in a line of a text file which is in turn used as part of the display of a HTML page. Standard text is fine, but the text are needs to be able to accept HTML code with "s (double-quotes) in for entry if image urls etc.... the trouble is the form escapes these characters with \ (backslashes) which are stored in the text file and consequently mess up the HTML on the page.

 

Not sure if that was clear, but if anyone can help me with how to take HTML code from a text area, store it in (1 line of) a text file and then include it on a web-page as an include - I would be most grateful as I am stumped. Even just to point me in the direction of some reading material.

 

I am not storing this data in a database as I have not got that far yet, but I am aware that would probably be a better way to do it.

 

TIA

 

arum

[paul2463]

have a look here at <A href="http://uk3.php.net/strip_tags"> Strip Tags </a>

[monk.e.boy]

Try storing stuff in the database first. It is easier and you will have to re-write so much of your code, it would be better to do it first.

[arumdevil]

thanks guys. Had a look at strip tags, but either I cannot get them to work or I didn't explain what I want properly.

 

What I am trying to do is let admin update a news & events page directly through the browser. Hence the HTML form. The input from the form is stored in a text file which is then called from the news & events page to display it.

 

I have this working fine - admin can even add <p> <br> tags etc and that works as expected. the problem is if they try to enter tags containing doublequotes - such as urls...

 

to try to make my point more clear, take the following example:

 

<form method="post">
    <input type="text" name="textin" />
</form>
    <?
        $var = '<span style="color:#F00;">Red text</span>';
        echo '1: '.$var;
        $post = $_POST['textin'];
        echo '<br> 2: '.$post;
    ?>
<br>
3: <span style="color:#F00;">Red text</span>

 

the above will output 3 strings of "Red text".

 

1 and 3 are always red, but if I paste

<span style="color:#F00;">Red text</span>

into the text box it doesn't show up red.

 

 

So I am not wanting to strip HTML tags as a security measure - conversely I want them to work, but can't figure it out. Security is not an issue in this case as the people editing will have already logged in...

 

I don't know if that explained my problem in a clearer way - hope so!

[kenrbnsn]

You want the function stripslashes() not strip_tags().

 

This will work:

<form method="post">
    <input type="text" name="textin" />
 <input type="submit" name="submit" value="test">
</form>
    <?php
 if (isset($_POST['submit'])) {
              $var = '<span style="color:#F00;">Red text</span>';
              echo '1: '.$var;
              $post = stripslashes($_POST['textin']);
              echo '<br> 2: '.$post;
    ?>
<br>
3: <span style="color:#F00;">Red text</span>
<?php } ?>

 

Ken

 

[arumdevil]

Magic! thanks so much that's exactly what I was after. I did play around with that one too but I couldn't get it to work - like I said I am new!