note 47198 deleted from function.nl2br by googleguy
| From: | googleguy@php.net | Date: | Thu, 13 Jun 2013 11:09:32 +0000 |
| Subject: | note 47198 deleted from function.nl2br by googleguy | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-195176@lists.php.net to get a copy of this message | ||
Note Submitter: php at keithtyler dot com
----
Take extreme care with nl2br(). It is a simple replacement function -- apparently equivalent to
preg_replace("\n","<br \>\n").
It should not be used on input from HTML textareas, unless all HTML tags are stripped from the input
first. nl2br() does not do anything special to newlines that occur within HTML elements (such as the
<a> anchor tag).
Some browsers will submit textarea data with newlines inserted at the points where the user's
input wrapped to the next line. This can cause anchor links to break and other erratic appearance of
HTML:
<a <br \>href=http://us2.php.net/manual/en/function.nl2br.php>PHP
nl2br()</a>
or worse:
<a href="http://www.site.com/user/page with
<br />spaces.html">URL with spaces</a>
A lot of people use nl2br() to allow their users to insert explicit line and paragraph breaks via
newlines, and their applications will exhibit this problem when used with such browsers.