Issues with /r/n/r/n when displaying escaped data

[Antivirus]

I'm having an issue where I need to display data for user to edit in a <textarea> field. For instance, user enters following data:

Posted the banner on my myspace profile. Also posted their video on my blog, etc...

Oh yes i did.

That's what I am talking about. "oh yeah" i said

And i use the input cleaner on it as TYPE_NOHTML and escape it using $db->escape_string() which stores it in the db like this:

Posted the banner on my myspace profile. Also posted their video on my blog, etc... \r\n\r\nOh yes i did.\r\n\r\nThat\'s what I am talking about. &quot;oh yeah&quot; i said

I'm actually escaping the user input with this before sending it to a custom datamanager which I have attached. That's where the save takes place.

PHP Code:

// Escape stuff to prevent Sql Injection from nasty people
$pagetext    = $db->escape_string($pagetext);
$url        = $db->escape_string($url);

// init fbpost datamanager class
$fbpostdata =& datamanager_init('scFbpost', $vbulletin, ERRTYPE_STANDARD);
// set existing data
$fbpostdata->set_existing($fbpost);
// set new data
$fbpostdata->setr('pagetext',    $pagetext);
$fbpostdata->setr('url', $url);
$fbpostdata->pre_save();
$fbpostdata->save(); 


Then to diplay the data I loop through the SQL result as follows:

PHP Code:

while ($fdbkdetail = $db->fetch_array($feedbackdetail_result)) 
{
    // Create the feedback post id
    $fbpostid    = $vbphrase['feedback'] . " Post id:" . $fdbkdetail['postid'];
    
    // Parse the listbit template
    eval('$feedbackbits .= "' . fetch_template('sc_myteams_feedback_bit') . '";');
} 


Anu idea how to get the data to display in the <textarea> field as entered, and without all the /r/n stuff?

Thanks

[Adrian Schneider]

You don't have to escape it when using the datamanager, since they will call it for you. Only use it when sticking unsafe strings into queries.

[Antivirus]

ah , i see. So the datamanager class already takes care of escaping, etc... I wasn't aware of that. I searched throughout class_dm.php for $db->escape_string but couldn't find it so i didn't think that was being handled.

Thanks, they should put you on staff here.

[Adrian Schneider]

It would be $this->dbobject->escape_string there.

[Antivirus]

AH YES THAT'S RIGHT!, ok i'm learning, lol