Re: html entities

On Sat, 5 Mar 2005 11:00:03 -0800 (PST), fluidliqatyahoodotcom <fluidliq@yahoo.com> wrote: > I tried using the html_entity_decode with the third parameter. But PEAR's QuickForm still > displays "&" as "&amp" in the values of the text elements. It just > happen to the text elements. > What's wrong with this? As he said before, you need to update the script which is posting these values so that the char set is correct there. Then it should post the actual characters and not entities. > > Marek Kilimajer <lists@kilimajer.net> wrote: > fluidliqatyahoodotcom wrote: > > I never did anything to store it as HTML entities in the db. PEAR converted it itself and > > stored it into the db. > > on line 140 of common.php in the PHP PEAR, there is this line: > > $strAttr .= ' ' . $key . '="' . htmlspecialchars($value) . > > '"'; > > this line converts all the values to html entities with the htmlspecialchars(). > > This is ok, PEAR should do that. If it does not, your site would be > vulnerable to XSS atacks. > > > > > I tried things like html_entity_decode before storing into the db so that it will be saved > > as its characters but it didn't work. > > You should be able to use html_entity_decode(), but only with the third > parameter (charset). Look at > http://www.php.net/html_entity_decode if > your character set is supported. Else you will have to specify the > charset on the page so browser sends text in the right charset and not > in html entities. > -- Justin Patrin