How to prevent HTML code such as &lt; being rewritten as <

[webmasterATflymagnetic.com]

Folks,

I'm struggling to put the question together, but I have this problem.
I have written an HTML form that I can use for data entry. This uses
PHP to write a SQL UPDATE command that gets written to my MySQL
database. I can later view this data back in the form.

One thing I've noticed happening is if I enter code such as &lt; it
gets rewritten as < (ie the less-than sign). Now I don't want this to
happen, but something somewhere is converting this. This is annoying
because it messes up my HTML code.

The HTML form calls itself (ie $_SERVER['PHP_SELF']), and then builds
the UPDATE command. It pushes this out to the database using
mysql_query("UP DATE ..."). Is this something that is done by
mysql_query(), because it is clearly being stored on the database as
this.

Is this a feature of mysql_query(), or is there some other way to turn
this off?

Any help will be appreciated.

[Michael Fesser]

..oO(webmasterA Tflymagnetic.co m)

>Many thanks for this. After I posted I realised I could echo the
output that comes back into the script. And it clearly has already
been modified as soon as it comes back in. So the &lt; rewrite is
happening between the $_SERVER[$PHP_SELF] submission on the form, and
the next time the PHP file is sent back to the browser.

What does a

print "<pre>\n";
var_dump($_POST );
print "</pre>\n";

show after the form submission? The "&lt;" should still be there.

Then how do you show the submitted data again after the submission? Do
you use htmlspecialchar s() before the output? Without that the browser
would get the "&lt;" and interpret it, so you would get a literal "<".
With htmlspecialchar s() instead the result in the HTML source would be
"&amp;lt;", which would then be interpreted to the intended "&lt;".

Micha

[webmasterATflymagnetic.com]

SOLVED IT!! (Why do I always seem to find the answer shortly after
hitting the send button? -- Bummer!)

Anyway, what I've done is this:

<pre>
Return-Path: &\lt;em***@addr ess.com&\gt;<br />

I've not used any htmlspecialchar s() calls, and the above gets written
to my database entry exactly as shown. I did originally try \&lt; but
that simply resulted in \< -- so the escape never worked. At least
this way it does work.

So I'm a happy bunny...

tra la la, tra la la...

(if a little mad!)

Thanks all again!

[Franz Marksteiner]

webmasterATflym agnetic.com wrote:

SOLVED IT!! (Why do I always seem to find the answer shortly after
hitting the send button? -- Bummer!)

I just know what`cha sayin` ;-)

--
Freundliche Grüße,
Franz Marksteiner