Question

I have a multi line input text box in a webpage and want all the entered text to update another area of text in the page. How would I be best to achieve this? At the moment, I have it that when you submit the form, php writes the input to a small text file which is then embedded in the page.

But, do I need to sanitize this so that people don’t inject html. Also, do I need to make it add <p>...</p> tags for every line in the input box?

Thanks.

Answer 1

What you do depends on your requirements. You should definitely use htmlspecialchars() or strip_tags() to nullify any errant HTML. After that you can simply use nl2br() to insert some <BR> to space everything or you can explode() your string and add <p> tags.