开发者

Secure inserting value of $_POST['textarea'] into <textarea> HTML tag using PHP only

开发者 https://www.devze.com 2023-01-10 12:51 出处:网络
Is there any way to insert $_POST[\'textarea\'] into <textarea> without escaping shell special chars?

Is there any way to insert $_POST['textarea'] into <textarea> without escaping shell special chars? I do sth. like :

 <textarea>
     <?php 
           echo escapeshellcmd($_POST['textarea_field']) ; 
     ?>
 </textarea>  

and I have a problem with \ chars. I do not wont them in <textarea> but without escapeshellcmd(); function it is possible to post HTML </textarea> tag and insert whatever from HTML to javascript code after. Can you give me some advice regarding this problem, please? Can I insert posted data into textarea withou开发者_C百科t \ chars?

Thanks in advance for any suggestion.


Try it with htmlspecialchars. escapeshellcmd is for a different purpose, namely escaping shell commands.


Have you tried htmlentities or htmlspecialchars yet?

0

精彩评论

暂无评论...
验证码 换一张
取 消