CODEWITHSUNDEEP
phphtmltextarea
vt100
vt100

Reputation: 1003

Secure inserting value of $_POST['textarea'] into <textarea> HTML tag using PHP only

Is there any way to insert $_POST['textarea'] into <textarea> without escaping shell special chars? I do sth. like : 

 <textarea>
     <?php 
           echo escapeshellcmd($_POST['textarea_field']) ; 
     ?>
 </textarea>

and I have a problem with \ chars. I do not wont them in <textarea> but without escapeshellcmd(); function it is possible to post HTML </textarea> tag and insert whatever from HTML to javascript code after. Can you give me some advice regarding this problem, please? Can I insert posted data into textarea without \ chars?

Thanks in advance for any suggestion.

Upvotes: 0

Views: 2044

Answers (2)

dst
dst

Reputation: 1788

Have you tried htmlentities or htmlspecialchars yet?

Upvotes: 2

deceze
deceze

Reputation: 522250

Try it with htmlspecialchars. escapeshellcmd is for a different purpose, namely escaping shell commands.

Upvotes: 3

Related Questions