Add HTML Codes to XML file using PHP

Question

i have an xml file (scores.xml) which im using a php codes to add new Tags to it...

i have a tag called Header which contain some html code

<![CDATA[<tr><td colspan='7' id='headertd'>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
<img border='0' src='images/euro.png' />
&nbsp;&nbsp;&nbsp;&nbsp;
UEFA Euro 2012 Qualifications</td></tr>]]>

when im writing this code in the form of the pgp script and submiting everything goes normal to the XML file except the header tag.... im getting an error in the php script and the code is going in the xml tag like that:

<![CDATA[<tr><td colspan='7' id='headertd'>
       
<img border='0' src='images/euro.png' />
    
UEFA Euro 2012 Qualifications</td></tr>]]>

so thats getting wong info to my xml... is there anyway i can fix this ? and avoid the transformation of these codes?

thats my php code :

<?php
if (isset($_POST['submitted'])) {//If the user submitted the form, then add to the XML file
    //Load the scores XML file
    $scores = new DOMDocument();
    $scores -> load('../scores.xml');

    //Get the <Games> tag
    $games = $scores -> getElementsByTagName('Games');

    //Create the new <Game> tag (Could probably be done better by first placing everything in an array or something)
    $newGame = $scores -> createElement("Game");
    $newGame -> appendChild($scores -> createElement("Header", $_POST['header']));
    $newGame -> appendChild($scores -> createElement("Row", $_POST['row']));
    $newGame -> appendChild($scores -> createElement("Date", $_POST['date']));
    $newGame -> appendChild($scores -> createElement("Time", $_POST['time']));
    $newGame -> appendChild($scores -> createElement("HomeTeam", $_POST['hometeam']));
    $newGame -> appendChild($scores -> createElement("Score", $_POST['score']));
    $newGame -> appendChild($scores -> createElement("AwayTeam", $_POST['awayteam']));
    $newGame -> appendChild($scores -> createElement("Other", $_POST['other']));
    $newGame -> appendChild($scores -> createElement("InfoID", $_POST['infoid']));
    $newGame -> appendChild($scores -> createElement("InfoData", $_POST['infodata']));

    //Add the new <Game> tag under the <Games> tag
    $games -> item(0) -> appendChild($newGame);

    //Save again
    $scores -> save('../scores.xml');

    echo "New game added.";
}
?>

and this php is connected to a form that looks like that :

<form id="form1" method="post" action="">
<table id="table2">

<tr><td>Header:</td> <td><textarea style=" color:#000;" name="header" cols="73" rows="6" > </textarea></td></tr>

<tr><td>Row:</td> <td><input id='textfield' type="text" size="70" name="row" value='A or B' onfocus="inputFocus(this)" onblur="inputBlur(this)"></td></tr>

<tr><td>Date:</td> <td><input id='textfield' type="text" size="70" name="date" value='Date and time of the match' onfocus="inputFocus(this)" onblur="inputBlur(this)"></td></tr>

<tr><td>Time:</td> <td><input id='textfield' type="text" size="70" name="time" value='Current time' onfocus="inputFocus(this)" onblur="inputBlur(this)"></td></tr>

<tr><td>HomeTeam:</td> <td><input id='textfield' type="text" size="70" name="hometeam" value='Home Team' onfocus="inputFocus(this)" onblur="inputBlur(this)"></td></tr>

<tr><td>Score:</td> <td><input id='textfield' type="text" size="70" name="score" value='Score' onfocus="inputFocus(this)" onblur="inputBlur(this)"></td><td>"3 - 2"</td></tr>

<tr><td>AwayTeam:</td> <td><input id='textfield' type="text" size="70" name="awayteam" value='Away Team' onfocus="inputFocus(this)" onblur="inputBlur(this)"></td></tr>

<tr><td>Other:</td> <td><input id='textfield' type="text" size="70" name="other" value='Additional Info' onfocus="inputFocus(this)" onblur="inputBlur(this)"></td></tr>

<tr><td>InfoID:</td> <td><input id='textfield' type="text" size="70" name="infoid" value='The ID of the Popup' onfocus="inputFocus(this)" onblur="inputBlur(this)" ></td><td></td></tr>

<tr><td>InfoData:</td> <td><textarea id='textfield' value='Data of the Popup' onfocus="inputFocus(this)" onblur="inputBlur(this)" name="infodata" cols="73" rows="6"></textarea></td><td>

<tr><td> </td><td><input type="submit" name="submitted" name="Add new row"></td><td> <td></td> 

</table>

 <style>
 BODY {font-family:"Trebuchet MS", Arial, Helvetica, sans-serif; color:#333; font-size:11px;}
 #textfield {color:#888;}
 #table2 td, tr { padding-right:10px;}
 </style>

Answer 1

You can use the PHP function createCDATASection to add CDATA to your xml file:

Exchange

$newGame -> appendChild($scores -> createElement("Header", $_POST['header']));

for

$h = $scores -> createElement("Header"); //Create a empty <Header> tag
$h -> appendChild($scores ->createCDATASection ($_POST['header'])); //Add a CDATA element to it
$newGame -> appendChild($h); //Then append it to the game tag

With the comments, it should be quite straight-forward.

Answer 2

I think you should simply not use CDATA. There's a bunch of issues with it; By leaving it out I believe everything will work as expected.

What you have right now is effectively a double-encoding (using CDATA and added entities), so the result will be wrong in this case.

Answer 3

The code behind the form is probably saving the form values using something like:

htmlentities($xml_string);

If you are using a framework to handle the form submission it is possible that there is a flag that could be passed (True/False) to tell the framework to NOT use htmlentities when saving the data. However, make sure you are still validating the field in some way to prevent injection security holes. (Ex. - if storing in a DB use mysql_real_escape_string() or similar.)

You could try:

$scores = new DOMDocument();
$scores->substituteEntities = false;
$scores->load('../scores.xml');

Answer 4

I'd just let it look like that in the xml file, and when you retrieve it you would use the PHP function htmlspecialchars_decode to convert them back.

Example:

<?php
$s = "&lt;tr&gt;&lt;td colspan='7' id='headertd'&gt;&#xD;
    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&#xD;
    &lt;img border='0' src='images/euro.png' /&gt;&#xD;
    &nbsp;&nbsp;&nbsp;&nbsp;&#xD;
    UEFA Euro 2012 Qualifications&lt;/td&gt;&lt;/tr&gt;"; 
//The orginal $s is retrieved from the XML file

$s = htmlspecialchars_decode($s);
echo $s; //The orginal code is printed
?>