& < > |

Characters like this might be added to our input form. And will be stored in our MySQL database. But they are not validated in XHTML if we just print them as that. So I guess I should change them to &amp and so on before we show them on our page. Is there any PHP function that can do that or do I have to write a lot of lines that have to go though the text before I display it?


Probably the best solution is to do it when the text is uploaded, then we don't have to do it every time the page is viewed, but it's a bit late to think about that now, since we have a couple of Mb of data in 13 tables all ready...:(

Thanks for all oppinions.
ØØ

Are you allowing any HTML at all? If not, then htmlspecialchars() should do it.

Otherwise use a preg_replace() and use arrays as arguments.

Nope not allowing any HTML input. I am doing the same as this forum actualy. If they won't a quote, they write [quote] and if they want something bold, then they write [b]. then I change so it uses the propper CSS to form it.


My Pocket reference sais that htmlspecialchars() converts special characters to HTMNL entities, so if I am inputting & it prints &amp then I am happy. Will try it out.


Thanks
ØØ