Question

I have some pages that are stored in databases. For security purposes, all the pages is escaped before saved into the DB, but then when i print the page, the HTML-tags are still escaped. Like this

<a href=\"mypage.se\" alt=\"\">Link</a>

Obviously, that doesn’t work very well, so how do i unescape the pages?
I’ve tried with html_entity_decode without any success.

Answer 1

While data should be escaped before inserting it into the database, it shouldn’t still be escaped when you take it out. The root cause of your problem is that it is being escaped twice between collection and examining it after it comes out of the database.

You should track down why it is being escaped twice and fix that.

That may leave the existing data broken though (it depends on if the data is being escaped twice on the way in or if it is being escaped on the way out of the database with magic_quotes_runtime). If so, you will need to clean it up. That form of escaping has nothing to do with HTML and can be reversed with stripslashes.

The clean up will look something like:

1. SELECT * from database_table
2. Create a prepared UPDATE statement to update a row
3. foreach row stripslashes on the data that was double escaped, pass the data to the prepared statement