The forum operates in read-only mode. Please head to StackOverflow for support.

Wed, 07/02/2008 - 16:30

xcore

Joined: 02/07/2008

Posts: 6

Not formatting HTML in PHP (EXTREME DETAIL)

BOLD

mysql_connect($ip, $user, $pass) or die(mysql_error());
mysql_select_db("$user") or die(mysql_error());
$query = "SELECT * FROM news"; 
$result = mysql_query($query) or die(mysql_error());
while($row = mysql_fetch_array($result)){
   $news = $row['news'];
}
echo "$news";

Wed, 07/02/2008 - 21:22

a.m.

Joined: 20/04/2008

Posts: 256

Re: Not formatting HTML in PHP (EXTREME DETAIL)

Your HTML gets HTML-encoded. That is, special characters like < and > are being converted to < and >, respectively. Such encoding is normally expected in such places as shopping cart forms, etc, because it prevents from cross-site scripting attacks, but in this case, you want HTML un-encoded (as long as you trust the author of submitted text). You just have to figure out whether you encode the text before you put it in the database or after. If it's the former, you will have to decode the text (i.e. replace all sequences like < ", >, etc with original characters). If HTML is stored in the database as HTML, as it should be, then you just have to find a place where the text is encoded. htmlspecialchars is a typical function used for this kind of thing.

Thu, 07/03/2008 - 01:17

xcore

Joined: 02/07/2008

Posts: 6

Re: Not formatting HTML in PHP (EXTREME DETAIL)

alright so i can decode it BEFORE? right?
so i would use this htmlspecialchars says RIGHT before i insert it into the database. then when i recall it will show up as it is suppose to be?

Thu, 07/03/2008 - 01:28

xcore

Joined: 02/07/2008

Posts: 6

Re: Not formatting HTML in PHP (EXTREME DETAIL)

I am using it,

   if ( get_magic_quotes_gpc() )
      $postedValue = htmlspecialchars( stripslashes( $value ) ) ;
   else
      $postedValue = htmlspecialchars( $value ) ;

So now what?

Thu, 07/03/2008 - 01:57

a.m.

Joined: 20/04/2008

Posts: 256

Re: Not formatting HTML in PHP (EXTREME DETAIL)

xcore wrote:alright so i can decode it BEFORE? right?
so i would use this htmlspecialchars says RIGHT before i insert it into the database. then when i recall it will show up as it is suppose to be?

No. When you edit HTML in FCK editor, you want to store it in the database as unencoded HTML. That is, when you look at it through any DB tools, you will see <p>, <b>, etc. You still will need to encode quotes, so database can process HTML with quotes. When you read HTML from database, you will output it as is, without HtML-encoding it.

When somebody else edits HTML, you need to handle the output depending on who's the author and what functionality is being used. For example, in a form post like this one, you want to HTML-encode everything and then process BB-codes to render strings in bold, etc. Some sites accept HTML (as opposed to BB codes), but only allow some tags, like <b> and <i> in the HTML produced by the editor.

Thu, 07/03/2008 - 04:40

xcore

Joined: 02/07/2008

Posts: 6

Re: Not formatting HTML in PHP (EXTREME DETAIL)

&lt;p&gt;This is some &lt;strong&gt;sample text&lt;/strong&gt;. You are using &lt;a href=&quot;http://www.fckeditor.net/&quot;&gt;FCKeditor&lt;/a&gt;.&lt;/p&gt;

Thu, 07/03/2008 - 05:17

xcore

Joined: 02/07/2008

Posts: 6

Re: Not formatting HTML in PHP (EXTREME DETAIL)

OK i have no joke been searching google for 2 hours trying to figure out what you mean and what code to use but im lost.
Ive tried only you can help me.

Thu, 07/03/2008 - 08:13

xcore

Joined: 02/07/2008

Posts: 6

Re: Not formatting HTML in PHP (EXTREME DETAIL)

Solved proble, just had to remove the htmlspecial char...
And now verything works.

Thu, 07/03/2008 - 14:09

a.m.

Joined: 20/04/2008

Posts: 256

Re: Not formatting HTML in PHP (EXTREME DETAIL)

xcore wrote:Solved proble, just had to remove the htmlspecial char...
And now verything works.

That will do. Once again, though, make sure that only you or people you trust can submit HTML that gets published as is. If you let anybody else do that, your website will be vulnerable to a bunch of bad things.