Issues with /r/n/r/n when displaying escaped data

[Antivirus]

I'm having an issue where I need to display data for user to edit in a <textarea> field. For instance, user enters following data:

Posted the banner on my myspace profile. Also posted their video on my blog, etc...

Oh yes i did.

That's what I am talking about. "oh yeah" i said


And i use the input cleaner on it as TYPE_NOHTML and escape it using $db->escape_string() which stores it in the db like this:

Posted the banner on my myspace profile. Also posted their video on my blog, etc... \r\n\r\nOh yes i did.\r\n\r\nThat\'s what I am talking about. &quot;oh yeah&quot; i said



I'm actually escaping the user input with this before sending it to a custom datamanager which I have attached. That's where the save takes place.


// Escape stuff to prevent Sql Injection from nasty people
$pagetext = $db->escape_string($pagetext);
$url = $db->escape_string($url);

// init fbpost datamanager class
$fbpostdata =& datamanager_init('scFbpost', $vbulletin, ERRTYPE_STANDARD);
// set existing data
$fbpostdata->set_existing($fbpost);
// set new data
$fbpostdata->setr('pagetext', $pagetext);
$fbpostdata->setr('url', $url);
$fbpostdata->pre_save();
$fbpostdata->save();



Then to diplay the data I loop through the SQL result as follows:

while ($fdbkdetail = $db->fetch_array($feedbackdetail_result))
{
// Create the feedback post id
$fbpostid = $vbphrase['feedback'] . " Post id:" . $fdbkdetail['postid'];

// Parse the listbit template
eval('$feedbackbits .= "' . fetch_template('sc_myteams_feedback_bit') . '";');
}



Anu idea how to get the data to display in the <textarea> field as entered, and without all the /r/n stuff?

Thanks :)

[Adrian Schneider]

You don't have to escape it when using the datamanager, since they will call it for you. Only use it when sticking unsafe strings into queries.

[Antivirus]

ah , i see. So the datamanager class already takes care of escaping, etc... I wasn't aware of that. I searched throughout class_dm.php for $db->escape_string but couldn't find it so i didn't think that was being handled.

Thanks, they should put you on staff here. ;)

[Adrian Schneider]

It would be $this->dbobject->escape_string there.

[Antivirus]

AH YES THAT'S RIGHT!, ok i'm learning, lol