Trouble with htmlentities() and html_entity_dec ode()

[nathj]

Hi,

As you can tell by the subject of this post I'm having a spot of bother with htmlentities() and html_entity_dec ode().

I have built/am building a web site that allows user feedback. When the user enters their review of a resource it is stored in the database. It goes into a LONGTEXT field and what is entered is passed through htmlentities():
[php]
$reviewToStore = htmlentities($r eviewEntered, ENT_QUOTES) ;
[/php]
The results in the database appear fine:

Entered text = It's great a really useful resource
Stored text = It's great a really useful resource
 

When I come to display this review again I take the data from the table and pass it through html_entity_dec ode():
[php]
echo "<textarea> " . html_entity_dec ode($reviewFrom DB, ENT_QUOTES) . "</textarea"> ;
[/php]

This produces the output:

It\'s great a really useful resource
 

With the way my code is set up I think this is leading to some other problems further down the line, but I thought I'd start at the beginning and see if anyone knew why this might be happening. I've read over the manual and can't figure this one out.

Cheers
nathj

[Motoma]

Hi,

As you can tell by the subject of this post I'm having a spot of bother with htmlentities() and html_entity_dec ode().

I have built/am building a web site that allows user feedback. When the user enters their review of a resource it is stored in the database. It goes into a LONGTEXT field and what is entered is passed through htmlentities():
[php]
$reviewToStore = htmlentities($r eviewEntered, ENT_QUOTES) ;
[/php]
The results in the database appear fine:

Entered text = It's great a really useful resource
Stored text = It's great a really useful resource
 

When I come to display this review again I take the data from the table and pass it through html_entity_dec ode():
[php]
echo "<textarea> " . html_entity_dec ode($reviewFrom DB, ENT_QUOTES) . "</textarea"> ;
[/php]

This produces the output:

It\'s great a really useful resource
 

With the way my code is set up I think this is leading to some other problems further down the line, but I thought I'd start at the beginning and see if anyone knew why this might be happening. I've read over the manual and can't figure this one out.

Cheers
nathj

Why are you running html_entity_dec ode()? Do you want raw HTML placed in your document? It most surely mess up the TEXTAREA tags if you do.

[nathj]

Why are you running html_entity_dec ode()? Do you want raw HTML placed in your document? It most surely mess up the TEXTAREA tags if you do.

I may have simply misuderstood what this function does but I want quotes stored in the database as ' for example and then displayed properly on the front end.

Is this just not required?

Cheers
Nathan

[Motoma]

I may have simply misuderstood what this function does but I want quotes stored in the database as ' for example and then displayed properly on the front end.

Is this just not required?

Cheers
Nathan

Are you using MySQL? If I understand you correctly, what you are trying to do is allow yourself to store single quotes in the Database without screwing up your INSERT query. In that case, mysql_real_esca pe_string() is the best function for the job.
If I am misunderstandin g what you are attempting to do, please let me know.

[DavidPr]

If you do this going into the database:
[PHP]$reviewToStore = mysql_real_esca pe_string($_POS T['reviewEntered']);[/PHP]

This will add the slashes before the quotes and retain the '. This assuming that you're assigning the results of the form field "reviewEnte red" to the variable "reviewToStore" , which is the name of the database row you want to enter the results into. Results:
It\'s great a really useful resource

When you pull the information out of the database row "reviewToSt ore" to display in a Web page, use stripslashes() to remove the slashes put in by mysql_real_esca pe_string():

[PHP]$query = "SELECT * FROM tablename ORDER BY id";
$result = mysql_query($qu ery) or die(mysql_error ());
while($row = mysql_fetch_arr ay($result, MYSQL_ASSOC))
{
$id = $row['id'];
$reviewToStore = stripslashes($r ow['reviewToStore']);
}[/PHP]
Results:
It's great a really useful resource

[Motoma]

When you pull the information out of the database row "reviewToSt ore" to display in a Web page, use stripslashes() to remove the slashes put in by mysql_real_esca pe_string():

Sorry to cut in, but you are incorrect on this point. The slashes added by mysql_real_esca pe_string() are there only to allow MySQL to properly parse the SQL query. After you perform the INSERT statement, the data will reside in it's orginal, unescaped form in your table. This means that any SELECT queries will return a dataset in the exact format you need to use it.

$ins = "It's all good"; // It's all good
$ins = mysql_real_escape_string($ins); // It\'s all good
mysql_query("INSERT INTO `myTable` SET `textfield` = '$ins'"); // INSERT INTO `myTable SET `textfield` = 'It\'s all good'
/*
If you now perform a SELECT statement, you will see that the text field in the database actually holds "It's all good" and that there are no slashes. This is the exact way it will be retrieved from the database as well.
*/
 

[DavidPr]

Sorry to cut in...

No, by all means do.

So, there's really no need to do addslashes() when retrieving the information from the database when you use mysql_real_esca pe_string() then? Is this correct?

If so, then this will save me a little typing and that's a good thing.

[nathj]

Hi Guys (generic term non-gender specific),

Wow, this is great! I get to work in the morning and there loads of help waiting for me. What's more I now have it all working with a combination of mysql_real_esca pe_string() and stripslashes() for the reload to the text area. I hear what you're syaing Motoma and the manual agrees, however, the system showed the slashes on the reload as they were there in the database. So I added the strip slashes and evrything was great.

As I predicted in my original post solving this has resolved the other issues I had.

The review system I have now loads and closes and re-loads the review controls at will.

Thank's to you both for your help - I couldn't have cracked this without you.

Cheers
nathj

[Motoma]

Hi Guys (generic term non-gender specific),

Wow, this is great! I get to work in the morning and there loads of help waiting for me. What's more I now have it all working with a combination of mysql_real_esca pe_string() and stripslashes() for the reload to the text area. I hear what you're syaing Motoma and the manual agrees, however, the system showed the slashes on the reload as they were there in the database. So I added the strip slashes and evrything was great.

As I predicted in my original post solving this has resolved the other issues I had.

The review system I have now loads and closes and re-loads the review controls at will.

Thank's to you both for your help - I couldn't have cracked this without you.

Cheers
nathj

WELL!
If there are still slashed prevalent in your data, than you really didn't need to escape your dataset at all. I believe (with good reason) that you are working with magic_quotes_gp c enabled on your server, therefore any user posted data is escaped to begin with.

[nathj]

WELL!
If there are still slashed prevalent in your data, than you really didn't need to escape your dataset at all. I believe (with good reason) that you are working with magic_quotes_gp c enabled on your server, therefore any user posted data is escaped to begin with.

Motoma,

I just ran phpInfo() on the server and you are correct my host has magic_quotes_gp c set to ON. I'm learning stuff all the time here.

Thanks for the tip, it makes sense of what I was being told and what I was seeing happening. I've only been doing this for a 5 months and I've learned so much, largely from this forum, but then I kept realisinghow much more there is to learn!

Cheers
nathj