Answer the question
In order to leave comments, you need to log in
How to save text with tags in the database and display?
The user enters < b>hello b> - Save in the database as is
If output like this:
echo $text;
//We see hello
But this is not safe, the user can enter a js script (xss attack)
If we escape:
echo htmlspecialchars($text )
//We see plain text as is < b>hello b>
How to make it so that the user can enter text with tags (create tables, text boldness, etc.), but cannot create anything else (scipt. input. select), etc.
For example, as in habr, I can change text boldness, italics, create a list - BUT <script> can't
Answer the question
In order to leave comments, you need to log in
Didn't find what you were looking for?
Ask your questionAsk a Question
731 491 924 answers to any question