CodeIgniter form helper text input fields causing html parsing

Question

I am using CodeIgniter and on an edit form its pulling in data from the database. Sometimes this data contains apostrophes, ampersands etc..

How can i get CI to not parse this and change it to HTML version so end users can edit it.!

This is an image of the edit form, this text field has data pulled in from the database and populated into the input text field. The data does not contain any special chars as you can see in the second image below.

enter image description here

Here is a screenshot of how the data looks in the table, note i am only pulling from the far right column. Not the 4th column: enter image description here

As you can tell the data isnt being stored as html converted, yet CI is still converting it.

Here is a snippet of the above text field:

<?php    
/**
 * Form Field attribute settings
 * @author Mike DeVita
 */
$companyname = array(
    'name'  => 'companyname',
    'placeholder' => 'Enter Your Companies Name',
    'id'    => 'companyname',
    'value' => set_value('', $points['pointFields']['companyname']->uf_fieldvalue),
    'maxlength' => 80,
    'size'  => 30
);
            <div class="_100">
                <p><?php echo form_label('Company Name', $companyname['id']); ?><?php echo form_input($companyname); ?></p>
                <?php echo form_error($companyname['id']); ?>
            </div>

Here is a snippet of the insert to database:

function addUserFieldHtml($compiledHtml){
    foreach ($compiledHtml as $cHK => $cHV){
        $data = array (
            'pointid' => $cHV['pointId'],
            'timestamp' => time(),
            'html' => $cHV['html'],
            'fieldid' => $cHV['fieldId'],
            'fieldvalue' => $cHV['fieldValue']
        );
        $this->db->insert('userfields', $data);

    }
}#end addUserFieldHtml() function

Thanks

I'm not quite sure how you're generating form elements, but I would guess you have a prep_for_form filter running? In any case, your best option might be to use html_entity_decode (php.net/manual/en/function.html-entity-decode.php) or a similar decoding function on the data after it's been retrieved from the database but before the editor is being rendered. — rjz
– rjz, Commented Apr 15, 2012 at 3:39
Can we see your actual code? How are you outputting the form inputs? — No Results Found
– No Results Found, Commented Apr 15, 2012 at 4:26

No Results Found · Accepted Answer · 2012-04-15 05:45:49Z

3

The issue is here:

$companyname = array(
    'value' => set_value('', $points['pointFields']['companyname']->uf_fieldvalue),
);

set_value() converts some characters to entities, and should only be used in raw HTML - not passed to any of the form helper functions, like so:

<input name="email" value="<?php echo set_value('email'); ?>">

This will call the form_prep() function which escapes the input string, something like this:

<input name="username" value="<?php echo form_prep($row->username); ?>">

So just change your config for value to this:

$companyname = array(
    'value' => $points['pointFields']['companyname']->uf_fieldvalue,
);

...and when used with form_input() or any of the other form helper functions for displaying an input, the value will be escaped properly for you. For example:

echo form_input('myinput', '</div>"someJunkInput"<?php'); // Good to go

answered Apr 15, 2012 at 5:45

No Results Found

103k38 gold badges199 silver badges232 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

NDBoost Over a year ago

Thanks a million, i shoulda read the doc more thoroughly.. Ill try to remember to offer you a bounty reward on this.

No Results Found Over a year ago

Thanks but don't worry about it, just spread the knowledge :)

Ashim Saha · Accepted Answer · 2012-04-15 04:25:17Z

1

CodeIgniter handles magic quote automatically in post variable and ensures that post variable does not carry any extra slash.

Hence you must ensure that you pass the data through addslashes() before running the query using simple_query() or query(). This ensures that your query is ok and not subject to sql injection. Do not use htmlspecialchars() or htmlentities() before database insert. That is a wrong practice.

However if you use $this->db->insert(); or $this->db->update() you do not need to apply addslashes() on post data.

Now before rendering data, use htmlspecialchars() in view. This will give you protection against XSS attack.

<input value="<?php=htmlspecialchars($val)?>" type="button">

answered Apr 15, 2012 at 4:25

Ashim Saha

1624 bronze badges

2 Comments

NDBoost Over a year ago

Your solution in regards to rendering data did not work.. added: 'value' => set_value('', htmlspecialchars( $points['pointFields']['companyname']->uf_fieldvalue) ), does not work.

Ashim Saha Over a year ago

Can you echo this $points['pointFields']['companyname']->uf_fieldvalue directly in the view directly and check whether & is there or not using view source.

Rolands.EU · Accepted Answer · 2013-03-20 11:16:45Z

1

I use it like this:

$tavall = html_entity_decode($task->description, ENT_QUOTES, 'UTF-8');

then in form input (in my case textarea):

form_textarea(array(
    'name'          => 'task_description',
    'id'            => 'task_description',
    'value'         => set_value('task_description', $tavall), // 
    'rows'          => 10,
    'cols'          => 40,
))

same for text inputs will work.

answered Mar 20, 2013 at 11:16

Rolands.EU

1497 bronze badges

Comments

Himanshu Saini · Accepted Answer · 2015-11-07 10:42:23Z

From CodeIgnitor 3.0 documentation:

set_value($field[, $default = ''[, $html_escape = TRUE]])
Parameters: 
$field (string) – Field name
$default (string) – Default value
$html_escape (bool) – Whether to turn off HTML escaping of the value
Returns:    
Field value

Return type:    
string

Permits you to set the value of an input form or textarea. You must supply the field name via the first parameter of the function. The second (optional) parameter allows you to set a default value for the form. The third (optional) parameter allows you to turn off HTML escaping of the value, in case you need to use this function in combination with i.e. form_input() and avoid double-escaping.

By setting the third parameter to false you can prevent conversion of quotes like below:

  ....
 'value' => set_value('control_name',$control[0]['control_name'],false),
  ....

Dan H · Accepted Answer · 2012-10-18 23:17:09Z

CodeIgniter automatically passes the $_POST array through htmlspecialchars() when you use set_value(). If you take a look at the set_value() function in the form_helper.php, you will see that the desired value is passed through form_prep() which executes a htmlspecialchars() on the desired field.

In order to avoid this, you need to extend the form_helper adding a third optional parameter that skips the form_prep() execution. Just copy the following code into a MY_form_helper.php and copy it to application/helpers/

<?php  if ( ! defined('BASEPATH')) exit('No direct script access allowed');

/**
 * Form Value
 *
 * Grabs a value from the POST array for the specified field so you can
 * re-populate an input field or textarea.  If Form Validation
 * is active it retrieves the info from the validation class
 * NEW: Added a third parameter prep to skip htmlspecialchars escaping
 *
 * @access  public
 * @param   string
 * @return  mixed
 */
if ( ! function_exists('set_value'))
{
    function set_value($field = '', $default = '', $prep = true)
    {
        if (FALSE === ($OBJ =& _get_validation_object()))
        {
            if ( ! isset($_POST[$field]))
            {
                return $default;
            }

            return $prep ? form_prep($_POST[$field], $field) : $_POST[$field];
        }

        return $prep ? form_prep($OBJ->set_value($field, $default), $field) : $OBJ->set_value($field, $default);
    }
}


/* End of file MY_form_helper.php */
/* Location: ./application/helpers/MY_form_helper.php */

Ema.jar · Accepted Answer · 2017-02-16 17:36:29Z

0

Use this code:

$test = 'hello "B"';
set_value('test', $test, false)

edited Feb 16, 2017 at 17:36

Ema.jar

2,4341 gold badge35 silver badges44 bronze badges

answered Feb 16, 2017 at 17:00

user3091567

1

Collectives™ on Stack Overflow

CodeIgniter form helper text input fields causing html parsing

6 Answers 6

2 Comments

2 Comments

Comments

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

6 Answers 6

2 Comments

2 Comments

Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related