Error in trying to pass large amount of data in textarea?

[Justin Tang]

Hi:
I'm trying to pass HTML codes via a form through textarea. It seems
that if I put in text larger than certain size, the data I receive
through the POST array becomes [first part of data]var_name = [data].
Is this a common problem in php? I'm currently using PHP 4.3.9
Here's the code:

<?=$test?> <!--data already distorted -->
<form action="<?=$_SELF?>" method="POST">
<textarea name="test"><?=$test?></textarea>
<input type="submit" name="update">
</form>

[Steve]

Justin:

In the example code you have given, your posted data (ie the contents
your variable $test) need to be escaped before being displayed or
re-inserted into the form - otherwise the HTML of the form is mixed up
with the HTML of your posted data.

Try something along these lines:

<?php
print htmlspecialchars( stripslashes( $_POST[ 'test' ] ) );
?>
<hr />
<form action="<?=$_SERVER['PHP_SELF']?>" method="POST">
<textarea cols="50" rows="10" name="test">
<?php
print htmlspecialchars( stripslashes( $_POST[ 'test' ] ) );
?>
</textarea>
<br />
<input type="submit" name="update">
</form>
(nb I added stripslashes() in case you have magic_quotes enabled)
---
Steve

[Michael Fesser]

.oO(Steve)

(nb I added stripslashes() in case you have magic_quotes enabled)

Before using stripslashes() you have to check the setting of magic
quotes with get_magic_quotes_gpc() to avoid errors. If MQ are off and
the text contains literal slashes your code will lead to broken data.
Don't rely on a specifc server configuration if you don't have control
over it (the same goes for short_open_tags and register_globals).

Micha

[Steve]

Micha:

All correct. I hesitated before including stripslashes() and I agree I
should really have added test code around it - but I ended up leaving
it in anyway after noting that the style of the OP's sample code was
from an earlier PHP epoch when MQ were likely to be on by default.
---
Steve

[Brion Vibber]

Justin Tang wrote:

I'm trying to pass HTML codes via a form through textarea. It seems
that if I put in text larger than certain size, the data I receive
through the POST array becomes [first part of data]var_name = [data].
Is this a common problem in php? I'm currently using PHP 4.3.9

Try adding enctype="multipart/form-data" to the <form> tag, as suggested
in comments to this bug: http://bugs.php.net/bug.php?id=22427 This may
or may not help.

(Also, you should escape output with htmlspecialchars(), and may need to
use stripslashes() if magic_quotes_gpc is active. But that's a general
issue...)

-- brin vibber (brion @ pobox.com)