-2

I have another problem with this forum. Everything is working good, just not posting HTML.

When I post threads without any html it shows on the thread view, but if I post stuff with html, bold etc it won't show at all.

Heres the post file

<?php

include "connect.php"; //connection string

if(isset($_POST['submit']))

{

   $name=$_POST['name'];

   $yourpost=$_POST['yourpost'];

   $subject=$_POST['subject'];

   if(strlen($name)<1)

   {

      print "You did not type in a name."; //no name entered

   }

   else if(strlen($yourpost)<1)

   {

      print "You did not type in a post."; //no post entered

   }

   else if(strlen($subject)<1)

   {

      print "You did not enter a subject."; //no subject entered

   }

   else

   {

      $thedate=date("U"); //get unix timestamp

      $displaytime=date("F j, Y, g:i a");

      //we now strip HTML injections

      $subject=strip_tags($subject);

      $name=strip_tags($name);

      $yourpost=strip_tags($yourpost); 

      $insertpost="INSERT INTO forumtutorial_posts(author,title,post,showtime,realtime,lastposter) values('$name','$subject','$yourpost','$displaytime','$thedate','$name')";

      mysql_query($insertpost) or die("Could not insert post"); //insert post

      print "Message posted, go back to <A href='index.php'>Forum</a>.";

   }



}

else

{

   print "<form action='post.php' method='post'>";

   print '<input type="hidden" name="name" value="' . $_SESSION[usr_name] . '" size="20"><br>';

   print "Topic title:<br>";

   print "<input type='text' name='subject' size='20'><br>";

   print "Your message:<br>";

   print "<textarea name='yourpost' rows='5' cols='40' id='new_thread'></textarea><br>";

   print "<input type='submit' name='submit' value='submit'></form>";



}

?>
<script language="JavaScript">
  generate_wysiwyg('new_thread');
</script>

And here is the thread view

<?php 

include "connect.php"; //mysql db connection here

$id=$_GET['id'];

$gettopic="SELECT * from forumtutorial_posts where postid='$id'";

$gettopic2=mysql_query($gettopic) or die("Could not get topic");

$gettopic3=mysql_fetch_array($gettopic2);

print "<div id='left'>";

print "<div id='navi-body'>";

print "<a href='index.php'>Back to main forum</a> <a href='post.php'>New Topic</a> <A href='reply.php?id=$id'>Reply</a>";

print "</div>";

print "<div class='content'>";

print "<div class='content-header yellow'>$gettopic3[title]</div>";

print "<div class='content-mid'>";

$message=strip_tags($gettopic3['post']);

$message=nl2br($message);

print "$message";

print "<br /><br />";

print "Posted by: $gettopic3[author] Created at: $gettopic3[showtime]";

print "</div>";

print "<div class='content-footer'></div>";

print "</div>";

$getreplies="Select * from forumtutorial_posts where parentid='$id' order by postid desc"; //getting replies

$getreplies2=mysql_query($getreplies) or die("Could not get replies");

while($getreplies3=mysql_fetch_array($getreplies2))

{

   print "<div class='content'>";

   print "<div class='content-header yellow'>$getreplies3[author] replied at $getreplies3[showtime]</div>";

   print "<div class='content-mid'>";

   $message=strip_tags($getreplies3['post']);

   $message=nl2br($message);

   print "$message";

   print "</div>";

   print "<div class='content-footer'></div>";

   print "</div>";

}

print " ";



?>

I want it to show HTML and non html.

4

1 回答 1

1

..但是你有 strip_tags() 函数,它从字符串(post)中删除任何 HTML 或 PHP 标记。

$message=strip_tags($getreplies3['post']);

您可能希望使用此函数的第二部分并为您希望允许的那些标签添加一些额外的参数。(如粗体、斜体等)

$message_with_some_html = strip_tags($getreplies3['post'], '<strong><em>');

我希望我是对的,请检查 PHP 文档... :)

此外,您可能希望在使用带有 htmlentities() 的客户端输入和一些正则表达式语句来过滤掉可能的攻击之前对 $_POST 变量进行消毒

于 2012-06-16T07:21:10.310 回答