text editor inside a form textarea ?

[Hal Halloway]

I want a text editor inside a form's textarea,

So I would see html markup and html entities - just like a text editor.
I also would want to be able to edit it all just like a text editor -
this is done in PHPMyadmin for example...is there an easy way to do this?

In a way i'm asking the browser to suspend rendering markup.

[WebRod]

euh...
echo "<textarea name='field1'>$ yourfield</textarea>";

??

Rod

"Hal Halloway" <Ha******@nospa m.net> a écrit dans le message de news:
zvCLd.1479$Kj4. 1311@trnddc09.. .

I want a text editor inside a form's textarea,

So I would see html markup and html entities - just like a text editor. I
also would want to be able to edit it all just like a text editor - this
is done in PHPMyadmin for example...is there an easy way to do this?

In a way i'm asking the browser to suspend rendering markup.

[Michael Vilain]

In article <41************ ***********@new s.club-internet.fr>,
"WebRod" <no****@bouygte l.fr> wrote:

euh...
echo "<textarea name='field1'>$ yourfield</textarea>";

??

Rod

"Hal Halloway" <Ha******@nospa m.net> a écrit dans le message de news:
zvCLd.1479$Kj4. 1311@trnddc09.. .

I want a text editor inside a form's textarea,

So I would see html markup and html entities - just like a text editor. I
also would want to be able to edit it all just like a text editor - this
is done in PHPMyadmin for example...is there an easy way to do this?

In a way i'm asking the browser to suspend rendering markup.

I've see such things but they're written in Javascript and only work on
IE:

http://sniptools.com/dhtml_editor.php

--
DeeDee, don't press that button! DeeDee! NO! Dee...

[Justin Koivisto]

Hal Halloway wrote:

I want a text editor inside a form's textarea,

So I would see html markup and html entities - just like a text editor.
I also would want to be able to edit it all just like a text editor -
this is done in PHPMyadmin for example...is there an easy way to do this?

In a way i'm asking the browser to suspend rendering markup.

I think this is what you are after:
<textarea><?p hp echo htmlentities($t he_code_string) ?></textarea>

That way, all HTML code will not be rendered (because "<" is replaced
with "&lt;" etc.), but it will show up as if you were viewing the source
of the document...

If that's not what you are after, take a look at this:
http://www.koivi.com/WYSIWYG-Editor/

[WebRod]

> I think this is what you are after:

<textarea><?p hp echo htmlentities($t he_code_string) ?></textarea>

That way, all HTML code will not be rendered (because "<" is replaced with
"&lt;" etc.), but it will show up as if you were viewing the source of the
document...

Actually you don't need to use htmlentities.
Because it is already in <textarea></textarea> it works fine!
So:
<textarea><?p hp echo $the_code_strin g ?></textarea>
OR
<?php echo htmlentities($t he_code_string) ?>
But no need of:
<textarea><?p hp echo htmlentities($t he_code_string) ?></textarea>

Rod

[Daniel Tryba]

WebRod <no****@bouygte l.fr> wrote:

Actually you don't need to use htmlentities.
Because it is already in <textarea></textarea> it works fine!
So:
<textarea><?p hp echo $the_code_strin g ?></textarea>
OR
<?php echo htmlentities($t he_code_string) ?>
But no need of:
<textarea><?p hp echo htmlentities($t he_code_string) ?></textarea>

So what will happen is $the_code_strin g just happens to have the string
"</textarea>" in it?

Not escaping is the first step towards XSS.

[Justin Koivisto]

Sorry if this posts twice, but it didn't show up through my reader, so
I had to use GG...
Unless you have another textarea in it....

<?php
$string='<b>Thi s</b> has a textarea: <textarea></textarea> This is bad
for the page.';
?>
<textarea><?p hp echo $string ?></textarea>

Also, I think that if you don't use htmlentities it won't validate via
W3C.

[Dani CS]

WebRod wrote:

I think this is what you are after:
<textarea><?p hp echo htmlentities($t he_code_string) ?></textarea>

That way, all HTML code will not be rendered (because "<" is replaced with
"&lt;" etc.), but it will show up as if you were viewing the source of the
document...

Actually you don't need to use htmlentities.
Because it is already in <textarea></textarea> it works fine!
So:
<textarea><?p hp echo $the_code_strin g ?></textarea>
OR
<?php echo htmlentities($t he_code_string) ?>
But no need of:
<textarea><?p hp echo htmlentities($t he_code_string) ?></textarea>

Never omit htmlentities when outputting untrusted content to your pages.
It doesn't matter where you place it, it can be harmful even inside an
HTML comment.

[WebRod]

> Never omit htmlentities when outputting untrusted content to your pages.

It doesn't matter where you place it, it can be harmful even inside an
HTML comment.

yes, you're perfectly right!!
I was thinking only about "format" tags like <h1>,<font> etc etc.

but you're right, it's always better to use htmlentities!!
I apologize for my wrong answer :(

Rod

[drdaeman]

This works OK and is XSS-safe:

<textarea><?p hp echo htmlspecialchar s($string); ?></textarea>

Or, if you want, that even if due to impossibility to represent some
characters in document charset browser had encoded them into &#nnn;
form they anyway will be shown as they were typed:

<textarea><?p hp echo preg_replace('/&amp;(#\d{1, 5}|[a-z]{1,10});/i',
'&\1;', htmlspecialchar s($string)); ?></textarea>

Both examples works fine in IE and Mozilla Firefox. Second example will
make some problems with Opera versions before 7.5 and there it'll be
hard to use &#-encodings for characters outside the document's charset.