|
Posted by Drakazz on 03/09/06 10:31
Just a quick correction to "Juan José Gutiérrez de Quevedo Pérez"'s
post:
When you want to output values into html, always use htmlspecialchars.
For example, if $text is '<!--', then this will be evaluated as
<textarea><!--</textarea> ... The same problmem would be with using "
inside html tags. So really, for text area always use html specialchars
to show the actual output that user would like to edit. This will be
sent to the server as normal text (in your html, you have > but when
osted you will receive >. So be quiet careful.
echo "<textarea>".htmlspecialchars($text)."</textarea>"; etc..
[Back to original message]
|