Guys, I've just recently started programming, and I need some help. I have a form, and for some reason I can't get it to filter out the HTML. I really need some help with this. I'd like that, if HTML is entered, it displays as the same text they entered. Meaning <b>test</b> would display as <b>test</b> instead of test.
Thanks
Does that prevent the code from being executed?
(2010-09-28, 04:52 AM)Ooka Wrote: [ -> ]Guys, I've just recently started programming, and I need some help. I have a form, and for some reason I can't get it to filter out the HTML. I really need some help with this. I'd like that, if HTML is entered, it displays as the same text they entered. Meaning <b>test</b> would display as <b>test</b> instead of test.
Thanks
Run the text you get from the form through
htmlspecialchars before using it anywhere.
This is assuming you use php, you can use similar functions in other languages.
Yeah, I use php, and when and where would I put this? In the form, before processing the information, in the output display, or what? :o
(2010-09-28, 05:48 AM)Ooka Wrote: [ -> ]Yeah, I use php, and when and where would I put this? In the form, before processing the information, in the output display, or what? :o
Ideally before processing the information, unless you need it intact for the processing in which case, before it goes out to the display
So is this how it could be used?
$new = htmlspecialchars('$_POST[message]', ENT_QUOTES);
echo $new;
Or am I doing it wrong?
Sorry to be such a bother.
(2010-09-28, 05:57 AM)Ooka Wrote: [ -> ]$new = htmlspecialchars('$_POST[message]', ENT_QUOTES);
echo '$_POST[message]';
Think about it, you just ran htmlspecialchars on $POST['message'] and saved it in $new but then you echoed out $_POST['message'] which hasn't changed.
Do this instead:
$new = htmlspecialchars($_POST['message'], ENT_QUOTES);
echo $new;
Damn, still isn't working for me lol. I'll figure something out I suppose. Just seems like the first line will only work in the file that processes the information, and the second line will only work in the output, and at the same time they won't work together.
I KNOW this is my problem, lol, just don't know what I'm doing wrong. XD
Thanks a bunch for all your help though.
Just do
echo htmlentities($_POST['message']);