Force text instead of HTML

Question

Hi. I'm having the following problem: I have a page where a user inserts text inside a textarea and then I output the contents of that textarea in another page (php).

If the user decides to insert, for example input type="text" name="_name" (can't use < and > or the text won't show, which is exactly my problem) then when showing the output I will have a textbox shown. I want to force text only to appear. Thank you.

Answer 1

If you want to output some special HTML characters, you can use function htmlspecialchars().

$textarea = '<input type="text" />';
echo htmlspecialchars($textarea);

This outputs <input type="text" /&rt;
It will be rendered properly as <input type="text" /> by the browser.

Answer 2

Use htmlspecialchars() to encode special HTML characters to their HTML entities (especially < to < and & to &).

Example:

<?php
echo "Pi is <4"; // HTML syntax error, '<' needs to be encoded properly
echo htmlspecialchars("Pi is <4"); // Ok, outputs 'Pi is &lt;4', which is proper HTML