[eZACKe]

I have a textarea in which a user can enter anything he wants. When he presses enter, the textarea input is stored into a database. Then, on a different page, I query the database to get the contents the user entered into the textarea and display it in a div.

The problem is if the user enters something like this:
Hello, how are you?

From,
Zack

In the div, this text is displayed as:
Hello, how are you? From, Zack

I don't want this, I want it to be displayed as the user entered (just like a forum post here on this site). So, I'm assuming what I have to do is replace when a user hit enter with a <br/>. How would I do something like this? Do textareas store this as something that I can just do a replace?

Thanks for the help!


Also, is there anything I should be hesitant about? Like, a user could enter html into this textarea and it would completely change my site. Is there a way to prevent this?<---EDIT: Used strip_tags()




EDIT:
I've tried:

$_POST['postInput'] = str_replace("<br>", "\n", $_POST['postInput']);  

But that doesn't work. It seems textareas don't capture pressing enter as \n?

This post has been edited by eZACKe: 04 July 2011 - 02:20 PM

[codeprada]

Textareas use "\n" as the newline character.

[eZACKe]

codeprada, on 04 July 2011 - 06:40 PM, said:

Textareas use "\n" as the newline character.

Well I have this:

	$_POST['postInput'] = strip_tags($_POST['postInput']);
	
		$_POST['postInput'] = str_replace("<br/>", "\n", $_POST['postInput']);  

$query = "INSERT INTO `forumPost` (thePost, topicAssoc, datePosted, poster, numberApples) 
						values(:post, :topic, NOW(), :posterEmail, 0)";
		$result = $pdo->prepare($query);
		$params = array(
		'post' => $_POST['postInput'],
		'topic' => $theId,
		'posterEmail' => $email_token
		);
		$result->execute($params);

And when I entered this into the textarea and submit:
Hello there
Zack

I expect it to go into the database as Hello there<br/>Zack

But it does not. What am I doing wrong?

[creativecoding]

Change this:

$_POST['postInput'] = str_replace("<br>", "\n", $_POST['postInput']);  

To this:

$_POST['postInput'] = str_replace("\n", "<br />", $_POST['postInput']);  

Proper use of str_replace:
str_replace(REPLACE THIS, WITH THIS, IN THIS STRING);

[eZACKe]

What a stupid mistake on my part.

Thanks for clearing that up. Works great now.

[SirHenrik]

Try running the input from the textarea trough the nl2br function.

<?php
$textInput = $_POST['textarea'];
$textInput = nl2br($textInput);
?>

Of course you will also have to sanitize the string - to prevent sql injection attacks.

[eZACKe]

SirHenrik, on 04 July 2011 - 06:52 PM, said:

Of course you will also have to sanitize the string - to prevent sql injection attacks.

I'm using PDO and prepared statements. That is unnecessary. Unless I'm missing something.

[SirHenrik]

eZACKe, on 04 July 2011 - 11:53 PM, said:

I'm using PDO and prepared statements. That is unnecessary. Unless I'm missing something.

In that case it wont be necessary. But that was not my point.