Re: HTML in MySQL?

[Jasper Bryant-Greene]

Jasper Bryant-Greene wrote:
> John Trammell wrote:
> 
>> $input = "This is <br> the \n input";    # value from user
>> $saved = "This is <br> the <br> input";  # value in database
>> $recovered = "This is \n the \n input";  # retrieved from db, != $input
> 
> 
> Please don't top-post. That is the perfect argument for not applying 
> nl2br() before saving the information in the database. It should be done 
> *when outputting* instead.
> 
> <?php
> $in = mysql_real_escape_string("This is <br> the \n input");
> mysql_query("INSERT INTO my_table (my_field) VALUES ('$in')");
> 
> $array =mysql_fetch_assoc(mysql_query("SELECT my_field FROM my_table"));
> print(nl2br($array['my_field']));
> ?>
> 
> works exactly as intended.
> 

Oh, and I should mention you probably want to htmlspecialchars() that 
data too, if you actually want to see the <br> and if you want to 
protect from XSS attacks etc.

-- 
Jasper Bryant-Greene
Freelance web developer
http://jasper.bryant-greene.name/