PHP如何unescape HTML

I have some pages that are stored in databases. For security purposes, all the pages is escaped before saved into the DB, but then when i print the page, the HTML-tags are still escaped. Like this

<a href=\"mypage.se\" alt=\"\">Link</a>

Obviously, that doesn't work very well, so how do i unescape the pages? I've tried with html_entity_decode without any success.

While data should be escaped before inserting it into the database, it shouldn't still be escaped when you take it out. The root cause of your problem is that it is being escaped twice between collection and examining it after it comes out of the database.

You should track down why it is being escaped twice and fix that.

That may leave the existing data broken though (it depends on if the data is being escaped twice on the way in or if it is being escaped on the way out of the database with magic_quotes_runtime). If so, you will need to clean it up. That form of escaping has nothing to do with HTML and can be reversed with stripslashes.

The clean up will look something like:

  1. SELECT * from database_table
  2. Create a prepared UPDATE statement to update a row
  3. foreach row stripslashes on the data that was double escaped, pass the data to the prepared statement

mysql database input strings should always be escaped using mysql_real_escape_string() and when they come out, they should be unescaped using stripslashes(). for numbers like id's, those should be converted to integers using int() and then range checked: for instance, AUTO_INCREMENT columns like id's by default start with 1. so for a validation check on anything you get from $_GET[] or $_POST[], check that your int()'ed number is >= 1. filter all your integers through int(). filter all your real numbers through doubleval(), unless you are working with monetary values and you have your own decimal number class - floating point can mangle money.

Use stripslashes($str) for retrieve the content and remove slashes added during insert content into database.

thanks