将javascript值保存为DB中的纯文本

This is the problem I get, for example, when an user inputs <script>top.location.href=’http://www.google.nl’;</script> I want my application to echo it as plain text. Now, this actually works with htmlspecialchars()

This example works for me:

$test = "<script>top.location.href=’http://www.google.nl’;</script>";
echo htmlspecialchars($test);

But, when the user submits the form, the data goes to my DB and then returns to a 'dashboard'. The value is now ''. Is there a way how I can save the data safe into my DB?

I add the values into the DB for my C# application in this way via SDK:

$onderwerp = htmlspecialchars(stripslashes(trim($_POST['onderwerp'])), ENT_QUOTES,'UTF-8',true);
$omschrijving = htmlspecialchars(stripslashes(trim($_POST['omschrijving'])), ENT_QUOTES,'UTF-8',true);

    $im = array('description' => mysql_real_escape_string($onderwerp),
                'message' => mysql_real_escape_string($omschrijving) ,
                'relation' => $_SESSION['username'],
                'messageType' => 70,
                'documentName' => $_FILES["file"]["name"],
                'documentData' => base64_encode(file_get_contents($_FILES["file"]["tmp_name"])));
    $imresponse = $wcfclient->CreateInboundMessage($im);
    echo $imresponse->CreateInboundMessageResult;

And then call them at my dashboard in this way:

$roc = array('relation' => $_SESSION['username']);
$rocresponse = $wcfclient->ReadOpenCalls($roc);
foreach ($rocresponse->ReadOpenCallsResult as $key => $calls){
   echo $calls->Description;
}

can you please check mysql-real-escape-string

mysql_real_escape_string() :

The mysql_real_escape_string() function escapes special characters in a string for use in an SQL statement

Also CHeck SQL Inject :SQL Injection

Example

<?php
$link = mysql_connect('localhost', 'mysql_user', 'mysql_password');
$item = "Zak's and Derick's Laptop";
$escaped_item = mysql_real_escape_string($item);
printf ("Escaped string: %s
", $escaped_item);
?>

Ouput :

Escaped string: Zak\'s and Derick\'s Laptop

Yes, read about mysqli_real_escape_string.