Question

My dilemma is this: I have a PHP page with a form that includes a textarea where the user can enter any kind of text. The code below is at the top part of my PHP page, to check whether or not the user has pressed the “Submit” button for the form, and to error-check all the user input:

<?php 
// check if user has pressed the Submit button earlier
if (isset($_POST['submit'])) {
    ...
    $loc = mysqli_real_escape_string($dbc, trim($_POST['location']));
    ...

The code below is the HTML/PHP code for the form, and the textarea specifically:

...
// location texarea entry
echo '<label for="location">Meeting location: </label><br />';
echo '<textarea name="location" id="location" cols="40" rows="5">' . htmlentities($loc) . '</textarea><br />';

// submit button
echo '<input type="submit" value="Submit" name="submit"/><br />';
...

When I enter, let’s say:

Testing testing...

...

<>// HELLO!!!

Into the textarea, but then fail one of the other checks on the page so the form/page is refreshed and shows an error, I want to retain what the user wrote in the textarea. But with the code I have, the stored text that is displayed turns into:

Testing testing...\r\n\r\n...\r\n\r\n<>// HELLO!!!

How can I “save” the textarea contents so it is identical to what the user wrote before the PHP page is refreshed? Can’t think of a solution. 🙁 Many thanks in advance!

Answer 1

You should echo the original $_POST['location'] value (with htmlentities), not the trimmed and mysql_real_escaped version of it.

$loc = null;
if (/* POST */) {
    $loc = $_POST['location'];
    ...
    $query = 'INSERT INTO ... "' . mysql_real_escape_string(trim($loc)) . '"';
    ...
}

echo '<textarea name="location" id="location" cols="40" rows="5">' . htmlentities($loc) . '</textarea><br />';