Converting back to HTML characters

Answer 1

http://us3.php.net/manual/en/function.htmlspecialchars-decode.php This is the answer to your problems.

I am not sure how you should store the HTML tags. Obviously you can't store them in their original form, and it is bloated to use them with special entities. I recommend instead linking to a file that can be accessed that holds the HTML in it.

OK, you can store them as such, but you should use http://us3.php.net/manual/en/function.addslashes.php this function, too.

I don't think it's efficient to store a large block of HTML in the field; I guess it depends on the size.

Answer 2

I wouldn't recommend storing entities in the database at all. Even for a user field that was to be treated as plain text, I would escape it it immediately before output.

However, here, it seems you have a trusted HTML string (e.g. from a catalog). So just store it as:

V3008-02, WS1 Drain Fitting 1” Straight w/Silencer

or:

A 'quote' is <b>bold</b>

and dump it directly to output. There's no reason to use even ” because you should be able to include it directly with the Unicode encoding of your choice (e.g. UTF-8).

Answer 3

The content should be stored in the database in the original form. For example:

<p>this is a paragraph</p>

should be stored exactly as:

<p>this is a paragraph</p>

To make SQL injection impossible just escape the input strings with a proper escape function and sanitize your data (for example if it is supposed to be an integer, do an (int) cast). If you're using a framework this will be done for you by the database layer. I used to also do my own escape functions which are pretty easy to do.

Upon display in an HTML page one should use htmlentities (or for example Zend_View's escape method). There is no imminent reason why one would not accept storing special characters in the database as long as the database accepts them and the content is safely output to prevet XSS and such.

The idea behind my arguments is that content should be "exportable" for any platform/place. So if it's an HTML page you are going to use htmlentities(), if it's a CSV file you're going to use CSV exporting functions to process that text, etc.