htmlspecialchars() and HTML code

From: Date: Fri, 08 Aug 2003 15:13:44 +0000
Subject: htmlspecialchars() and HTML code
Groups: php.general 
Request: Send a blank email to php-general+get-158855@lists.php.net to get a copy of this message
Hello- I'm working on a site where users have the option to type HTML code into a textarea, or upload HTML code from a local file which is then displayed in the text area. The obvious problem is that an uploaded file that contains a closing tag for a textarea can wreak havoc and eat up the rest of the page. So, in order to get it to display properly, I called htmlspecialchars() on the string and that works fine. After any editing has been done, I can convert the text back using html_entity_decode(). This seems to be a decent solution to the problem. However, if the user has included htmlentities in their code, won't these get converted when I call the decode function? Even something simple like using a '<' symbol for a little arrow. This would need to remain a '&lt;' and not get converted when html_entity_decode() is called. Anybody dealt with something along these lines before or have some idea of a good solution? Thanks- Thaddeus

« previous php.general (#158855) next »