note 47198 deleted from function.nl2br by googleguy

From: Date: Thu, 13 Jun 2013 11:09:32 +0000
Subject: note 47198 deleted from function.nl2br by googleguy
References: 1  Groups: php.notes 
Request: Send a blank email to php-notes+get-195176@lists.php.net to get a copy of this message
Note Submitter: php at keithtyler dot com ---- Take extreme care with nl2br(). It is a simple replacement function -- apparently equivalent to preg_replace("\n","<br \>\n"). It should not be used on input from HTML textareas, unless all HTML tags are stripped from the input first. nl2br() does not do anything special to newlines that occur within HTML elements (such as the <a> anchor tag). Some browsers will submit textarea data with newlines inserted at the points where the user's input wrapped to the next line. This can cause anchor links to break and other erratic appearance of HTML: <a <br \>href=http://us2.php.net/manual/en/function.nl2br.php>PHP nl2br()</a> or worse: <a href="http://www.site.com/user/page with <br />spaces.html">URL with spaces</a> A lot of people use nl2br() to allow their users to insert explicit line and paragraph breaks via newlines, and their applications will exhibit this problem when used with such browsers.

« previous php.notes (#195176) next »