don't forget to escape your database contents!
<textarea id="foo">
<?php echo htmlspecialchars($databasefield); ?>
</textarea>
otherwise you'll get problems with content that includes html-tags like 'foo </textarea>bar baz'
. the bar baz
would escape your textarea! this could lead to cross site scripting security problems (if you allow user input) or at least broken html. i used to punish fellow students by opening countless new windows with javascript if they forgot to sanitize the entries in their learning-by-doing guestbook apps. windows with images no sane person evers wants to see. good times :)
htmlspecialchars turns <, >, ", &, ...
into entities (<, >, ", &, ...
), preventing the content to break free.