How do I properly sanitize data received from a text area, when outputting it back into the text area?

php mysql html forms sanitization
Joel Verhagen picture Joel Verhagen · Feb 27, 2009 · Viewed 8.1k times · Source

A user will input text in a textarea. It is then inserted directly into a mySQL database. I use trim, htmlentities, mysql_real_escape_string on it and I have magic quotes enabled. How should I sanitize it when outputting that data back into a textarea?

Thanks for your help. I've never been too sure on the correct way of doing this...

Answer

Paolo Bergantino picture Paolo Bergantino · Feb 27, 2009

You shouldn't use htmlentities when saving it. You should use htmlentities when displaying it. The rule of thumb is not to encode/sanitize the data until you need to. If you do htmlentities on it when you save then you have to do html_entity_decode on the text when the user wants to edit the input. So you sanitize for what you need and nothing more. When saving it, you need to sanitize for SQL injection, so you mysql_real_escape_string it. When displaying, you need to sanitize for XSS, so you htmlentities it.

Also, I am not sure if you saw Darryl Hein's comment, but you really do not want magic_quotes enabled. They are a bad, bad, thing and have been deprecated as of PHP 5.3 and will be gone altogether in PHP 6.

Related questions

Preserve Line Breaks From TextArea When Writing To MySQL

I'm using a textarea to enable users to input comments. However, if the users enters new lines, the new lines don't appear when they are outputted. Is there any way to make the line breaks stay. Any idea how do …

Read More
Delete multiple rows by selecting checkboxes using PHP

I want to delete multiple rows from MYSQL database. I have created this delete.php file to select various links and delete them using checkboxes. <html> <head> <title>Links Page</title> </…

Read More
Using a Submit Button to insert an entry into a MySQL database via PHP?

I'm pretty new to PHP, so I'm not quite sure on what to do with this. Basically I'm trying to insert an entry into my MySQL database, through a "submit" button in HTML. I can't seem to get this to …

Read More