Question

I have this code

       require_once("../Packages/Connection.php");
       $create_object = mysql_query("SELECT * FROM `Articles` WHERE `group` = 'News' ORDER BY `id` DESC;");

      while($row=mysql_fetch_array($create_object))
        {
        $time = $row[time];
        $date = date("H:i M jS o ",$time);
        print "<form action='Update.php' method='post' float:left;>

                <input hidden='hidden' name='articleId' value='$row[id]'>

                <input hidden='hidden' name='method' value='update'>

                <textarea name='articleText' rows='3' cols='25'>$row[text]</textarea>
                <br />  
                <input type='submit' value=' Update '>
            </form><br />
            <form action='Update.php' method='post'>

                <input hidden='hidden' name='articleId' value='$row[id]'>

                <input hidden='hidden' name='method' value='delete'>

                <input type='submit' value=' Delete ' onClick='return confirmDelete()'float:left;'>

            </form>     
         <hr><br />";
         }  

And it outputs the text alright, it changes the new line to <br /> but every time I update, it adds a new, so first time I enter a text like:

Hi
My name is Jesper

it outputs Hi <br />
My name is Jesper to the database

and second time if i want to change something, like the name..
Hi <br /><br />
My name is JapSeyz

and it continues to add <br />'s.. how do I limit this to only one?

Answer 1

That’s because you are using nl2br before storing the text to database. Go and see it there…

The right way is to escape the data (e.g., nl2br) only when viewing. The data in the database should be clear, without any modifications regarding escaping for a particular purpose.

In the <textarea> element, though, new-lines are already handled without need to insert <br> elements in there.

So do not use nl2br when storing data and use it only when printing on a page (not in the form element).