TEXTAREA field. Keeping newlines, but keep input to DB safe

[eirika]

Hi,

 

PHP newbie here, and my first post.

I am in the process of learning PHP. Currently I am looking at forms and DB input.

 

I would like to verify if my current method of keeping the linebreaks from a TEXTAREA field, and still keep the DB input safe is correct.

I use the following code to get the input from the TEXTAREA field.

 $comments = mysql_real_escape_string(nl2br(filter_var($_POST["comments"], FILTER_SANITIZE_STRING)));

Is this the correct way of handling this?

 

Thanks

[scootstah]

The only problem with this is that if you display the data back into a textarea, you will have to convert the <br />'s back into newlines otherwise you will have a bunch of <br />'s in your textarea.

 

So you can either do that, or use nl2br() on output instead of input.

[AyKay47]

Hi,

 

PHP newbie here, and my first post.

I am in the process of learning PHP. Currently I am looking at forms and DB input.

 

I would like to verify if my current method of keeping the linebreaks from a TEXTAREA field, and still keep the DB input safe is correct.

I use the following code to get the input from the TEXTAREA field.

 $comments = mysql_real_escape_string(nl2br(filter_var($_POST["comments"], FILTER_SANITIZE_STRING)));

Is this the correct way of handling this?

 

Thanks

it is recommended to use nl2br() to output data from your db, not on insertion, as mentioned.

[eirika]

Thanks,

 

I see.

nl2br() should be used for output, and is not necessary for the input to the DB.