0

The problem is after inserting into the database, the html tags like p,h2 etc. is there together with the user's input.

I tried the php function mysqli_real_escape_string but it doesn't work. The html tags are still in the db.

<script src="tinymce/tinymce.min.js"></script>
<?php 
include 'connection.php';

if(isset($_POST['submit'])){
    $msg = mysqli_real_escape_string($conn, $_POST['msg']);
$sql = mysqli_query($conn, "INSERT INTO messages(msg) VALUES('$msg')");
}
?>
    <form action="" method="post">
        <textarea name="msg" id="editor">   </textarea>
        <input type="submit" name="submit" value="Submit">
    </form>

    <script>
        tinymce.init({
  selector: 'textarea#editor',
  auto_focus: 'element1',
  width: "200",
  height: "200"
});
</script>

I want is after saving the inputs there is no html tags in the database.

2
  • 1
    strip_tags() ? ... though, why implement TinyMCE (a WYSIWYG editor) if you don't want HTML in the system (there's nothing inherently wrong with having HTML in the database btw)? You should also look at prepared statements with bound parameters. Commented Feb 5, 2019 at 14:44
  • It might be a good addition to keep the breaks str_replace("<br>", "\n", $_POST['msg']) before calling strip_tags() Commented Feb 5, 2019 at 14:48

2 Answers 2

2

Use strip_tags() function.

<?php

$msg = strip_tags($msg);
Sign up to request clarification or add additional context in comments.

Comments

1

If you want to remove the html tags, you can use strip_tags().

$_POST['msg'] = strip_tags($_POST['msg']);

Comments

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.