Secure inserting value of $_POST['textarea'] into <textarea> HTML tag using PHP only.

Question

Is there any way to insert $_POST['textarea'] into <textarea> without escaping shell special chars? I do sth. like :

 <textarea>
     <?php 
           echo escapeshellcmd($_POST['textarea_field']) ; 
     ?>
 </textarea>  

and I have a problem with \ chars. I do not wont them in <textarea> but without escapeshellcmd(); function it is possible to post HTML </textarea> tag and insert whatever from HTML to javascript code after. Can you give me some advice regarding this problem, please? Can I insert posted data into textarea without \ chars?

Thanks in advance for any suggestion.

Answer 1

Try it with htmlspecialchars. escapeshellcmd is for a different purpose, namely escaping shell commands.

Answer 2

Have you tried htmlentities or htmlspecialchars yet?