How to store html in mysql database

Question

I am trying to store HTML in a database, so when I retrieve a form from the database, I need to show it as a form, not text. Is there any way to do this?

This is a form

$form = "<form id='' method='' action='' class=''> <input type='hidden' name='my-item-id' value= $uid /> <input type='hidden' name='my-item-name' value=$title /> <input type='hidden' name='my-item-price' value='1' /> <input type='hidden' name='my-item-qty' value='1' /> <input type='submit' name='my-add-button' class='button' value='Add to cart'/> </form>"; 

the moment I retrieve the above from the database, it displays as text,

also a form field in the varchar(1000) database varchar(1000)

 include('adodb.inc.php'); include('adodb-pager.inc.php'); $sql = 'select title as "TITLE",description as "DESCRIPTION",form as "ADD TO CART" from mathspapers order by sysdate desc'; $pager = new ADODB_Pager($db,$sql); $pager->Render(); 

thanks

Answer 1

When you save text to a database, you are probably using addslashes() .
Then, when you return the text from the database, you need something like stripslashes() before displaying the text in HTML format. PHP Guide to stripslashes

Answer 2

Instead of storing the entire form template (and values) in the db field, I can advise you to store only the field field names and data (values) as key-value pairs.

You can easily use them if you store them in a standard way; (use on the form processing page)

 $form_data = "my-item-id=".$_POST["my-item-id"]."&my-item-name=".$_POST["my-item-name"]."&my-item-price=".$_POST["my-item-price"]."&my-item-qty=".$_POST["my-item-qty"]; 

then save $ form_data only in db

use data from db (of course, after pulling $ form_data from db) you can use parse_str

 parse_str($form_data,$form_data_from_db); 

echo $ form_data_from_db ["my-item-id"] will print your saved form input, for example

But this is not my main advice. How will you build your template for each saved data field? Just create a function to create the form, as most cms do.

try it;

 function myform_pattern_1($id,$method,$action,$class,$form_data){ parse_str($form_data,$fd); $form_html = "<form id='' method='' action='' class=''>"; $form_html .= "<input type='hidden' name='my-item-id' value='".$fd["my-item-id"]."' />"; $form_html .= "<input type='hidden' name='my-item-name' value='".$fd["my-item-id"]."' />"; $form_html .= "<input type='hidden' name='my-item-price' value='".$fd["my-item-id"]."' />"; $form_html .= "<input type='hidden' name='my-item-qty' value='".$fd["my-item-id"]."' />"; $form_html .= "<input type='submit' name='my-add-button' class='button' value='Add to cart'/>"; $form_html .= "</form>"; return $form_html; } 

Call this function where you like how;

 echo myform_pattern_1("form_id","post","","form_class",$form_data); 

This use has a big advantage for your method. You can change the syntax of the form whenever you want. You may want to integrate the JQuery validation plugin later, or just want to use a different style or even change the syntax by adding tags, you will have to change all stored db fields if you store the entire form on db. Using the function is much more flexible. Also, you will not use db to store unnecessary repeat tags, etc.

I hope you enjoy it, cys

For more information about parse_str; http://php.net/manual/en/function.parse-str.php enter code here

Answer 3

If I had to guess, I would say that your VARCHAR field is too small to cover all the HTML code, so the tag is somewhere truncated, resulting in HTML being displayed as text.

Answer 4

My guess, without any further confirmation, is that you are converting the html form into your safe html equivalents, so it just displays the text as text, it's just text.

Double check your conclusion that the actual source code is not like < for <

Answer 5

From the PHP documentation for htmlspecialchars: Some characters are of particular importance in HTML; translations made are most useful for everyday web programming. If you need to translate all HTML character characters, use htmlentities () instead.

The result is stored in db, and then when it is pulled from db.

Do you have that.