\\n appears as \n in an input tags -- using htmlspecialchars() on user input

StackOverflow https://stackoverflow.com/questions/21081446

Question

I have a simple issue -- the user fills out a form and when the form is POST'd I store the data into a HEREDOC and save that to a file that can be opened and viewed in the browser.

The problem is I can't figure out how to get the user's typed text input 100% faithfully re-displayed within an html 'input' tag.

Here's an example of my troublesome user input:

 oh' mesquid"ly b\\n;"'

When I open the file to redisplay that bit of data, it fails because of the quoting:

    <input type="text" id="theSubject" value='oh' mesquid\"ly b\\n;\"''/>

All I see in this input field is oh

So I tried htmlspecialchars() -- and that gets me almost there -- but I lose one of the 2 backslashes before the 'n' in my sample text string, and the output looks like oh' mesquid"ly b\n;"'

Here's the code -- 'myTitle' here got filled with the above oh' mesquid"ly b\n;"' by me, the user, I typed it into the form then POST'd the form (and as I preview this question here, I notice that the StackOverflow post text input has the same problem -- despite the fact that I typed in two "\" backslashes in the 1st line of this paragraph, as I view my question here before submitting it I note that one of the backslashes is missing, sorry about that, out of my control):

 <?php

   $title = $_POST['myTitle'];
   $theEscapedTitle = htmlspecialchars($title, ENT_QUOTES);

   $html = <<<HEREDOC

   <?php
      \$title = '$theEscapedTitle';   
   ?>

   <!DOCTYPE html>
   <html>
   <body>
      <input type="text" id="theSubject"value='<?php echo $title ?>'/>
   </body>
   </html>  

   HEREDOC;

   file_put_contents("myFile.php", $html);

 ?>

When I open "myFile.php", the above 'input' tag looks like this:

    <input type="text" id="theSubject" value='oh&#039; mesquid&quot;ly b\n;&quot;&#039;'/>

Why am I losing one of the 2 backslashes in my input text string oh' mesquid"ly b\n;"' and what should I do to faithfully reproduce the text string?

EDIT

I got a workable solution below and had to tweak it a bit, here's the solution to my problem:

 function reproduceBackslashesFaithfully($string) 
 {
      $string = str_replace('\\','\\\\',$string);
      $string = htmlspecialchars($string, ENT_QUOTES);
      return $string;
 }

When I pass this function my user's input containing doubled backslashes, I now see those double backslashes faithfully reproduced in my input tag in my code above. I'm looking into why the original 'pass by reference' of the function parameter given in the answer by Anonymous below did not work for me, as the PHP docs indicate that pass-by-reference function parameters should work in my PHP version 5.3.5.

Was it helpful?

Solution

This should double the backslashes and fix the apostrophes as well:

<?php
    function clean(&$string) {
        $string = str_replace('\\','\\\\',$string);
        $string = htmlspecialchars($string, ENT_QUOTES);
    }
?>

And you can easily implement it by using clean($var)

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top