Secure inserting value of $_POST['textarea'] into <textarea> HTML tag using PHP only
Is there any way to insert $_POST['textarea']
into <textarea>
without escaping shell special chars?
I do sth. like :
<textarea>
<?php
echo escapeshellcmd($_POST['textarea_field']) ;
?>
</textarea>
and I have a problem with \
chars. I do not wont them in <textarea>
but without escapeshellcmd();
function it is possible to post HTML </textarea>
tag and insert whatever from HTML to javascript code after. Can you give me some advice regarding this problem, please? Can I insert posted data into textarea
withou开发者_C百科t \
chars?
Thanks in advance for any suggestion.
Try it with htmlspecialchars
. escapeshellcmd
is for a different purpose, namely escaping shell commands.
Have you tried htmlentities or htmlspecialchars yet?
精彩评论