Basically when you submit some text to the database with html in it, the html is processed.

For security reasons how can i make sure that html tags and such are not processed?

i think there is something in asp like an encode function, is there a php version of this?

addslashes()

When returning data use...

stripslashes()

What this does is inserts an escaping character around anything that could break the code. In addition, if you use htmlspecialchars() that will turn special characters like non-breaking spaces into their character equivalent.

The addslashes and stripslashes commands should never be forgotten, of course. But take a gander at these funtions to strip out only certain HTML tags (or attributes) from a variable, handy to limit the amount of HTML a user can post...

// ------------------------------------------------------------------------------------------------
function view_safe($variable) {
$variable = removeEvilTags($variable);
$variable = removeEvilAttributes($variable);
return $variable;
}
// ------------------------------------------------------------------------------------------------
function removeEvilAttributes($tagSource, $strip_attribs="onmouseover|onmouseout|onclick|ondblclick|onmousedown|onmousemove|onkeypress|onkeydown|onkeyup")
{
$stripAttrib = "' ($strip_attribs)=\"(.*?)\"'i";
$tagSource = stripslashes($tagSource);
$tagSource = preg_replace($stripAttrib, '', $tagSource);
return $tagSource;
}
// ------------------------------------------------------------------------------------------------
function removeEvilTags($source, $allowed_tags="<a><br><b><h1><h2><h3><h4><i><em><img><p><strong><u><ul><font>")
{
$source = strip_tags($source, $allowed_tags);
return preg_replace('/<(.*?)>/ie', "'<'.removeEvilAttributes('\\1').'>'", $source);
}

Passing the $allowed_tags and $strip_attribs is optionable, unless you wish to change the default tags and attributes. An example snippet of it in use could be...

foreach( $_POST as $k => $v ) {
echo(view_safe($v));
}