Question

I have this function that takes some user-submitted HTML code from the database:

function Code($code)
{
    return "<pre><code>".nl2br(htmlspecialchars($code))."</code></pre>";
}

I’ll just be calling it like echo code($query->row('html'));. I know my question lacks ‘depth’, but is this the best way to do it? Or could the outputted formatting be parsed (e.g. Javascript injections), or not output correctly on some machines, etc.?

Thanks!

Jack

EDIT: I have a new (related) question: I would like to highlight the string using highlight_string(). However, I cannot make it work properly. I think I understand why but am not too sure how I can rectify this.

function Code($code)
{
    return "<pre><code>".highlight_string(nl2br(htmlspecialchars($code)))."</code></pre>";
}

As you can see from that I’m using highlight_string() on it all. however, the output isn’t highlighted at all, instead it is output as character entities (<, ‘>’ etc). If I reshuffle the function ordering to something like:

return "<pre><code>".nl2br(htmlspecialchars(highlight_string($code)))."</code></pre>";

I find that the character entities aren’t output, but the string still isn’t highlighted. To clarify, I have no CSS formatting that would affect the text colour applied either. Also, I’ve checked my PHP settings and there are definitely highlighting colours specified in there.

Answer 1

Nope, that’s fine. htmlspecialchars() will turn any HTML control character into its entity equivalent (< => < etc.), there is no way of injecting anything there.