PHP echo() MySQL result containing <> characters?

Question

I am retrieving data from my SQL database...

data exactly as it is in the DB = (21:48:26) <username> some text here. is it ok?

when i try and echo $row['log']."<br>";

it displays it as = (21:48:26) some text here. is it ok?

i assume this is due to the <> brackets making it think its an HTML opener... would this be the case? and if so how would one echo a string that contains HTML?

Answer 1

Use htmlspecialchars() to translate HTML control characters into their entities:

echo htmlspecialchars($row['log'])."<br>";

Answer 2

You need to escape the characters so it is not recognized as an HTML element, but as text:

echo htmlentities( $row['log'] ) . '<br/>';

Answer 3

i assume this is due to the <> brackets making it think its an HTML opener...

Yes, any construction in <> brackets is treated by web browser as HTML tag. So, you should use either htmlspecialchars() or htmlentities() or some similar custom function to convert "<" and ">" symbols to "&lt;" and "&gt;" strings, which are displayed to user as brackets.

Some more comments:

• ALL text data displayed to user must be passed through htmlspecialchars() funciton (or through other function with similar behavior), since "some text" may also contain tags, etc.

• Probably it would be better to store date/time, username and "some text" in separate table columns in DB, in order to satisfy relational database constraints. This may require some additional input data parsing.