Working with HTML Entities

Question

I am storing HTML code in my MySQL table column. For inserting records, I framed the query like this:

$InsertQuery = "INSERT INTO listing (ldate, places, company, designation, projectdetails, desiredcandidate, hrname, hrcontact, email) VALUES (DATE_FORMAT('" .$ldate ."','%Y/%m/%d'),'" .$places. "','" .$company. "','" .$designation. "','" .htmlentities($projectdetails). "','" .htmlentities($desiredcandidate). "','" .$hrname. "','" .$hrcontact. "','" .$email. "')";

But when I am output the results using following code, it shows the text with HTML tags. It is not implementing the tags on the page.

$FetchResultsQuery = "SELECT * FROM listing WHERE recordid=" . $SelectedRowID;

 $result = mysql_query($FetchResultsQuery);
 $row = mysql_fetch_row($result);
 if ($row)
 {
  $PostedDate = date($row[0],'d.m.Y');
  $Places =  $row[1];
  $Company = $row[2];
  $Designation = $row[3];
  $ProjectDetails = $row[4];
  $DesiredCandidate = $row[5];
  $HRName = $row[6];
  $HRContact = $row[7];
  $Email = $row[8];
 }

       <td valign="top" style="padding-left:10px; text-align:justify;"><h4>&nbsp;</h4>
          <p><strong>Company Name: </strong> <strong><?PHP echo $Company; ?></strong></p>
          <p>&nbsp;</p>
          <p><strong>Location: </strong> <?PHP echo $Places; ?> </p>
          <p>&nbsp;</p>
          <p><strong>Posted Date: </strong><span class="style19"> <?PHP echo $PostedDate; ?></span></p>
          <p>&nbsp;</p>
          <p><strong>Designation:</strong><?PHP echo $Designation; ?></p>
          <p>&nbsp;</p>
          <p><strong>Project Details :</strong></p><br>
     <?PHP echo $ProjectDetails; ?> 
          <p>&nbsp;</p>
          <p><strong>HR Name: </strong> <?PHP echo $HRName; ?> </p>
          <p>&nbsp; </p>
          <p><strong> HR's Contact details: </strong><?PHP echo $HRContact;  ?></p>
          <p>&nbsp;</p>
          <p><strong>Email: </strong><?PHP echo $Email;  ?></p>
          <p><span class="style18"><strong><br />
            <br />
          </strong></span></p></td>
        <td></td>

Answer 1

Try to echo like this:

print html_entity_decode('your text here');

Answer 2

The problem is that the htmlentities function converts all your angle brackets to their HTML entity equivalent. So instead of outputting '<' you will just get '&lt;'.

When storing data in the database, more often than not you will want to store it in it's raw format i.e. un-encoded, as you might not always want to display the data in HTML e.g. you might want to export it to CSV. You would typically use htmlentities when outputting the data in the browser.

If you haven't done so already - it's a bit hard to tell from your INSERT code snippet - you might want to modify your SQL to pass your parameters through the mysql_real_escape_string or use prepared statements instead.