PHP Echo Succurity - HTML Forums

COnlineMarket · 10-23-2009, 09:25 PM

Hello,
I am in the process of making a site where users can enter in text into my database. Then it can be viewed from somewhere on the site.

I have it set up like this.
They enter text into text area.
Then it saves in database
Then users can see it.

Right now if they type in something like "Hello<br> adfad" Then when my website echos the variable out it echos the whole thing and it looks like it would in HTML

But i want it to look exactly like what they typed.

I dont want my users to be able to add their own HTML , just plain text, Because I dont know what sort of damage they can do. and I dont want them to distort the page.

So what I want to know is,

Does anyone have any ideas on how i can make it so that the text entered is outputed as text only?

bowrider · 10-23-2009, 10:32 PM

Hi COnlineMarket
You can use the srip_tags() function to strip html tags from anything the user types in like so,

Code:


	PHP Code:
	
		
			
$to_post = strip_tags($_POST['user_posted_text'];

As a heads up there are other security measures you will probably want to take but
I will leave that to someone more saavy than I. I don't want to accidentally steer you wrong!

you can read more on this function here.
http://us3.php.net/manual/en/function.strip-tags.php

COnlineMarket · 10-24-2009, 08:09 AM

Hey thanks, ill give this a try.

Vege · 10-25-2009, 05:59 PM

example provided by bowrider is little faulty.

If you wan't to display all data like it was provided without change of security breach:
if UTF8 only the magic five needs to be converted (<>&"') to entities:

PHP Code:


			
echo nl2br(htmlspecialchars($data_from_database_or_from_post));

In other popular encodings "all" have to be transformed to entities:

PHP Code:


			
echo nl2br(htmlentities($data_from_database_or_from_post,ENT_QUOTES));

You might wanna add striptags there if you don't wanna see the html tags someone might have tried, but it will not make your output any safer, just might look visually better.

Thou if you use striptags it might remove unwanted data if people insert tags by accident:

Quote:

I used to have <5 childrens, now i have 6>

You need also to take account magic_quotes or ' and " will look like \' and \".
http://www.htmlforums.com/serverside...on-100193.html

Here is a easy cheatsheet of charactes to make sure your displaying the data correctly: &<d>'"€हिन्दी