Question

I have an issue with sending POST data from my form. There is a <textarea> in the form where i’m trying to paste some data which contain a tag <script> (e.g. a code of counter for website traffic, it doesn’t matter).

<form action="/savepage" method="POST">
   <button type="submit">Save</button>
    <fieldset>
            <textarea name="content">
              Some <b>text</b>
              <script src="script_source" type="text/javascript"></script>
            </textarea>
    </fieldset>
</form>

After the form was submitted I receive the $_POST array which contains all fields of my form, but tags <script> are missing in the $_POST['content'] variable. This problem does not occur when I insert any other tags in the same field.

var_dump($_POST["content"]);

gives

string(18) “Some <b>text</b>

“

Can anybody explain me what happens with the tags <script> in the <textarea> field when submitting the form and why they are absent in the $_POST['content'] variable? The back-end of my site is on the Kohana Framework v.2.4. Perhaps it’s Kohana who cut tags… Or, maybe, is there an option in the Apacahe or PHP settings which can do this things?
Thanks in advance.

Answer 1

If you put the <script>-tag in before, you need to encode it, so that the browser does not parse the content

So – use htmlspecialchars():

<form action="/savepage" method="POST">
   <button type="submit">Save</button>
    <fieldset>
            <textarea name="content">
<?php echo(htmlspecialchars('
              Some <b>text</b>
              <script src="script_source" type="text/javascript"></script>'); ?>
            </textarea>
    </fieldset>
</form>