Saving inputs/textareas and quotes

Strip_tags is not the adecuate filter

[asantos]

Hi. I have several forms on my CMS. And 2 BIG problems:

1) When someone enters this inside a <textarea>:

Hi! this is some content</textarea> for my website!

@ It gets saved, but if i reload the form with that content, the "for my website!" tile gets lost out of the textarea.

2) Trying to implement a solution for the first problem, I inserted the strip_tags() function before saving the data, BUT the content must allow HTML because is a post for a news module.

I thought about using html_entity and html_entity_decode but i dont think that would solve the problem.

Any ideas?

[coopster]

You could allow only certain HTML tags. Have a look at the second argument to the strip_tags [php.net] function.

[asantos]

The thing is, i want to allow ALL tags that ARENT <textarea>.

[dreamcatcher]

htmlspecialchars might be what you want:

[uk2.php.net...]

dc

[asantos]

dreamcatcher, i implemented this function with the help of the function you told me to use:

function s($data,$html=false) {
if($html) {
$data = htmlspecialchars($data);
} else {
$data = strip_tags($data);
}
return $data;
}

That way i use the $html flag depending on the control:

1) Inputs: s($data)
2) Textareas: s($data,true)

Now i'm stuck with another problem. I can't use quotes in the inputs.

If I insert:
My name is "andres"

I get:
My name is \

What could be the solution for that?

[eelixduppy]

Try:
s(addslashes [us3.php.net]($data));

[FourDegreez]

If you only want to filter </textarea> why not forget the html-specific functions and just do a string replace for </textarea>?

As for quotes getting messed up, I use this function:

function fixInput($value) {
if (get_magic_quotes_gpc())
return stripslashes($value);
else
return $value;
}

[asantos]

Thanks!