Question

I am inserting data into a table which contains some basic html tags, double quotes and single quotes.

I am using the following line to handle the data:

htmlentities(($_POST[content]), ENT_QUOTES);

The problem with this is that when I select this data to bring it back onto the screen, displays the actual html tags instead of rendering the html, i.e. if I use the <b>bold</b> tag, is displays it as text instead of making the text within that tag bold. If I don’t use the above line, i.e.

htmlentities(($_POST[content]), ENT_QUOTES);

Then I can’t insert the data into the database because the data can contain single quotes and double quotes.

How do I deal with this issue?

So basically, I should be able to insert the data into the database where single or double quotes should not cause a problem. When when rendering the data back onto the screen, it should render html tabs as they should get rendered into the browser and the quotes should be displayed as quotes in the text being rended back onto the screen.

Answer 1

$html = mysql_real_escape_string($html);

http://php.net/manual/en/function.mysql-real-escape-string.php

Make sure you have made a proper mysql connection mysql_connect before using this function.