views:

59

answers:

1

If the return value of a mysql query contains "" and / the content is displayed outside the textarea

content = <a href="url">link</a>

echo() is used inside the textarea

<textarea><?php echo $row['value']; ?></textarea>

the textarea displays <a href= and what follows it is displayed outside the textarea

How do I contain all html inside the textarea?

+4  A: 
htmlspecialchars($row['value'])
David Dorward
@David Dorwad, thank you very much!
dany
@dany: Note you must use `htmlspecialchars()` *every* time you put text into HTML elements and attribute values, not just in `<textarea>`. If you allow untrusted content into your HTML without escaping you're going to get cross-site-scripting security holes.
bobince