How to stop an html TEXTAREA from decoding html entities

Question

I have a strange problem:

In the database, I have a literal ampersand lt semicolon:

<div  

whenever its printed into a html textarea tag, the source code of the page shows the > as >.

How do I stop this decoding?

Answer 1

In PHP, this can be done using htmlentities(). Example below.

<?php
  $content = "This string contains the TM symbol: &trade;";
  print "<textarea>". htmlentities($content) ."</textarea>";
?>

Without htmlentities(), the textarea would interpret and display the TM symbol (™) instead of "™".

http://php.net/manual/en/function.htmlentities.php

Answer 2

You can't stop entities being decoded in a textarea[1] since the content of a textarea is not (unlike a script or style element) intrinsic CDATA, even though error recovery may sometimes give the impression that it is.

The definition of the textarea element is:

<!ELEMENT TEXTAREA - - (#PCDATA)       -- multi-line text field -->

i.e. it contains PCDATA which is described as:

Document text (indicated by the SGML construct "#PCDATA"). Text may contain character references. Recall that these begin with & and end with a semicolon (e.g., Hergé's adventures of Tintin contains the character entity reference for the e acute character).

This means that when you type (the invalid HTML of) "start of tag" (<) the browser corrects it to "less than sign" (<) but when you type "start of entity" (&), which is allowed, no error correction takes place.

You need to write what you mean. If you want to include some HTML as data then you must convert any character with special meaning to its respective character reference.

If the data is:

<div

Then the HTML must be:

<textarea>&amp;lt;div</textarea>

You can use the standard functions for converting this (e.g. PHP's htmlspecialchars or Perl's HTML::Entities module).

NB 1: If you were using XHTML[2] (and really using it, it doesn't count if you serve it as text/html) then you could use an explicit CDATA block:

<textarea><![CDATA[&lt;div]]></textarea>

NB 2: Or if browsers implemented HTML 4 correctly

---

Ok , but the question is . why it decodes them anyway ? assuming i've added & , save the textarea , ti will be saved &lt; , but displayed as < , saving it again will convert it back to < (but it will remain < in the database) , saving again will save it a < in the database , why the textarea decodes it ?

• The server sends (to the browser) data encoded as HTML.
• The browser sends (to the server) data encoded as application/x-www-form-urlencoded (or multipart/form-data).

Since the browser is not sending the data as HTML, the characters are not represented as HTML entities.

If you take the data received from the client and then put it into an HTML document, then you must encode it as HTML first.

Answer 3

You have to be sure that this is rendered to the browser:

<textarea name="somename">&amp;lt;div</textarea>

Essentially, this means that the & in < has to be html encoded to &. How to do it will depend on the technologies you're using.

UPDATE: Think about it like this. If you want to display <div> inside a textarea, you'll have to encode <> because otherwise, <div> would be a normal HTML element to the browser:

<textarea name="somename">&lt;div&gt;</textarea>

Having said this, if you want to display <div> inside a textarea, you'll have to encode & again, because the browser decodes HTML entities when rendering HTML. It has nothing to do with your database.

Answer 4

I had the same problem and I just made two replacements on the text to show from the database before letting it into the text area:

myString = Replace(myString, "&", "&")
myString = Replace(myString, "<", "&lt;")

Replace n:o 1 to trick the textarea to show the codes. replace n:o 2: Without this replacement you can not show the word "" inside the textarea (it would end the textarea tag).

(Asp / vbscript code above, translate to a replace method of your language choice)

Answer 5

You can serve your DB-content from a separate page and then place it in the textarea using a Javascript (jQuery) Ajax-call:

request = $.ajax
({  
    type: "GET",
    url: "url-with-the-troubled-content.php",           
    success: function(data)
    {
        document.getElementById('id-of-text-area').value = data;    
    }
}); 

Explained at

http://www.endtask.net/how-to-prevent-a-textarea-element-from-decoding-html-entities/

Answer 6

I found an alternative solution for reading and working with in-browser, simply read the element's text() using jQuery, it returns the characters as display characters and allows me to write from a textarea to a div's innerHTML using the property via html()...