user data text formating textarea

[NeilsPHP]

I am wondering how to use php to make a 'textarea' type of user data entry box that the user will have options to format text..just like word.(color text..hyperlink..font..copy..paste etc)
I want user to have flexibility to format their own data before submitting.
thanks

[cameraman]

That's a job for javascript. There are several already written out there, tinyMCE and fckeditor to name a couple.

[dreamcatcher]

Google for 'Rich Text Editor'.

dc

[NeilsPHP]

thanks for reply.I tried FCKeditor and does the job.But is it safe to use these editors for site users or developers? FCKeditor returns plain text when i try to sanitize the post data using htmlspecialchars and stripslashes.Any other ways to sanitize data to avoid XSS attacks etc using these editors ?

[cameraman]

You can undo the htmlspecialchars with htmlspecialchars_decode when you want to display it. You could also just base64_encode [us3.php.net] it for storage and decode it to display. That will increase the storage requirements, but it's definitely database-safe.

[NeilsPHP]

really appreciate it.thanks

[NeilsPHP]

oh..just found out that both htmlspecialchars_decode and base64 encode/decoding works,but I still loose the formatting in the display which I want using fckeditor..anything I am doing wrong ?

[cameraman]

Use get_magic_quotes_gpc() [us.php.net] in script to see if php is escaping the content before you get ahold of it. If so, either turn it off if you can, or use stripslashes() [us.php.net] on the content.

[NeilsPHP]

I am sorry for getting little confused..do i add stripslashes before entering data in mysql or before using it out of db ?
(tried both but no satisfactory results)
I am using this funtion before putting data into mysql using POST.
But when I am trying to recover html formatted data,its returning plain text.

function cleaner($data)
{

$data = trim($data);
$data = stripslashes($data);
$data = strip_tags($data);
$data = rtrim($data);
$data = ltrim($data);
$data = htmlspecialchars($data);
$data = mysql_real_escape_string($data);
return $data;
}

any suggestions ?

[dreamcatcher]

Yes, before as you are doing. But you only need to use it if magic quotes are on:

$data = (get_magic_quotes_gpc() ? stripslashes($data) : $data);

dc

[NeilsPHP]

I tried that way,but still getting plain text.then I started to comment out each instruction one by one,and found out that nobody BUT strip_tags is the one that is causing it.In other words,I can leave everything else the way it is and comment out as below and i get html data as entered in the form using fck editor.

function cleaner($data)
{

$data = trim($data);
$data = stripslashes($data);
$data = (get_magic_quotes_gpc() ? stripslashes($data) : $data);
// $data = strip_tags($data);
$data = rtrim($data);
$data = ltrim($data);
$data = htmlspecialchars($data);
$data = mysql_real_escape_string($data);
return $data;
}

But my questions,can I LEAVE it like this ? any security holes ? any preventive measures I can take ?