Question

I’m trying to pull a string out of my mysql DB and use a working to add <br /> tags to it. But it’s not working and I cant work out why

if(mysql_num_rows($res)){
    echo '<div id="contents">';
    while($row = mysql_fetch_array($res)){
    $UserName = $row['UserName'];
    $Message = $row['Message'];

    $MessageW = wordwrap($Message, 10, "<br />\n");

      echo '<div><strong>' .
            $UserName . ': </strong>' .
            $MessageW . '</div>';
    }
    echo '</div>';
  }

Can anyone help me?

Answer 1

It’s unlikely that all words in your message have a length of 10 characters. By default, PHP does not cut in words, so pass a fourth parameter of true to force cutting in the middle of words.

Also, your code is vulnerable to XSS. To solve this, first wordwrap it, then convert the result to HTML and finally convert newlines:

$MessageW = wordwrap($Message, 10, "\n", true);
$MessageW = htmlentities($MessageW);
$MessageW = nl2br($MessageW);