Stack Exchange
save html-formatted text to database
I want to save html-formatted text to database, but when I do that it is don't save html-symbols like < / > ' and others
This is how I read article from database for editing:
<p class="Title">Англійський варіант:</p>
    <textarea name="EN" cols="90" rows="20" value="<?php echo htmlentities($articleArr['EN'], ENT_QUOTES, "UTF-8"); ?>" ></textarea>

after this generates such html-code:
<p class="Title">Англійський варіант:</p>
    <textarea name="EN" cols="90" rows="20" value="&lt;p class=&#039;Title&#039;&gt; привыт &lt;/p&gt;" ></textarea>

So, I expect that this text will appear in my text field, in html-code of this page it is, but in text area is no.
In database I save it as:
<p class="Title"> Hello </p>

So how can I do the follow:

Read from database
html-formattedtext.
Show it in textarea element.
Edit and save it back to database.

Help me please, how can I save such texts properly, Thanx!

Are you sure it doesn't save html-symbols like < / >?

yes, it don't save such symbols

it does. it simply does.

As for the other symbols, such as ' or \ , always do $ParentName = mysql_real_escape_string($ParentName); and so on for the every variable you put into query in quotes

Textarea has both opening and closing tags. and no value attribute.

If it don't have value atribute - how can I save edited article to database? How to assign variable and textarea field? Why it was working ealier when I used value attribute??

Heh, he's right, didn't spot that.  Textareas work unlike most form inputs.  Looks like this <textarea name="textarea">Stuff Goes In Between the Tags</textarea> rather than <textarea name="textarea" value="Stuff doesn't go in value"></textarea>

Oh, also, the stuff between the tags is it's value, it all gets put into $_POST or $_GET or whatever by the name of the textarea element.  So, <textarea name="comments">Blah blah blah blah blah</textarea> would be $_POST['comments'] and would equal "Blah blah blah blah blah".  If you had a string $string = "Blah blah blah blah blah" and output echo '<textarea name="comments">'.$string.'</textarea>'; then you'd get a text area with "Blah blah blah blah blah" prefilled in.

Try using htmlspecialchars() on the string to put into the DB, and then, when pulling it back out, use htmlspecialchars_decode().  Might make a difference.

Certain characters have special significance in HTML, and should be represented by HTML entities if they are to preserve their meanings. This function returns a string with some of these conversions made; the translations made are those most useful for everyday web programming. If you require all HTML character entities to be translated, use htmlentities() instead.

Save it to a nvarchar(max) field.
Make sure you use parameterized queries for security. Read 
http://www.aspnet101.com/2007/03/parameterized-queries-in-asp-net/ 
http://msdn.microsoft.com/msdnmag/issues/04/09/SQLInjection/
with little changes to   Sql , you can apply to Mysql aslo 

there is no problem with save your html code in database. and no need for filter data before save .
but when you want to show it again in textarea you shoud Escape it.
in php you can use this code to escape html codes:
PHP Function

see doc: htmlspecialchars
$cotnent = htmlspecialchars( $cotnent );


Wordpress Functions:

see doc: format_to_edit
$cotnent = format_to_edit( $cotnent , false );


OR

see doc: esc_textarea
$cotnent = esc_textarea( $cotnent );


