nl2br（）不会输出换行符，只是'n'

Question

It's pretty simple, I have a text area post on my website, and if I input:

line 1
line 2
line 3

into it, it outputs:

line 1nline 2nline 3

My insert code is:

    $status = strip_tags(stripslashes(htmlentities(mysql_real_escape_string($_POST['status']))));
    $uid = strip_tags(stripslashes(htmlentities(mysql_real_escape_string($_POST['uid']))));

    //more stuff

        $sid = rndTxt(16);
        $status = nl2br($status);
        if (!get_magic_quotes_gpc()) {
            $status = addslashes($status);
        }


    $insert = mysql_query("INSERT INTO mingle_status (uid,sid,status,`timestamp`) VALUES ('$uid','$sid','$status',now())") or
    print mysql_error();

and my output code:

while($st = mysql_fetch_assoc($statussql)) {
    $status = stripslashes($st['status']);
    $sid = $st['sid'];
    $td = $st['timestamp'];
?>
<div id="n">
<div id="statuses" class="<?php echo $sid; ?>">
<p><?php echo $status; ?></p>
<div id="statuscomadd" style="background:#E0E0E0;">
<a href="ld.php?uid=<?php $uid; ?>&pid=<?php echo $sid;?>&method=like">Like</a> <a href="ld.php?uid=<?php $uid; ?>&pid=<?php echo $sid;?>&method=dislike">Dislike</a><a href="#" id="time"><?php echo time_since($td) . " ago"; ?></a>
</div>  
</div>

Any help would be greatly appreciated!:)

Answer 1

you dont need to use nl2br() on insert, you will have to use it while displaying in html

and will have to remove stripslashes before insert

Answer 2

When inserting just do a mysql_real_escape_string() over the values. You only want to change the data (eg by using htmlentities() when you are going to display it).

Please also consider to stop using mysql_* functions for new code. They are no longer maintained and the community has begun the deprecation process . See the red box ? Instead you should learn about prepared statements and use either PDO or MySQLi . If you can't decide, this article will help to choose. If you care to learn, here is a good PDO tutorial .

Another thing: do you realy need htmlentities() ? Because imo a better solution is to use htmlspecialchars() . Otherwise all html entities will be replaced.

Also I don't think you need to use strip_tags() , because you are already doing htmlspecialchars() to protect you against XSS.

Now for you problem is it because you are using stripslashes() which breaks the \\n linebreaks. I think you can just drop those add/stripslashes .

Answer 3

You use strip_tags(stripslashes(htmlentities(mysql_real_escape_string()))); which strips the slashes from \\n .

Just use mysql_real_escape_string() , or htmlentities( ,ENT_QUOTES) for HTML.

Also, if it's possible use an UTF-8 encoding and htmlspecialchars() instead of htmlentities() . htmlentities() converts every character which has an HTML-representation, while htmlspecialchars() converts only the necessary characters. There's no need to convert everything. See: htmlentities vs htmlspecialchars