htmlspecialchars

This function is also very important for forms containing HTML-code. A web-based HTML-editor can look like this:

<PRE>
<FORM ACTION=/old?u=http%3A%2F%2Fwww.php.net%2Fmanual%2Fja%2Fbla%26gt&y=1999
<H2>Restaurant Description<H2>
Name of restaurant:
<INPUT TYPE=text NAME="restname"
VALUE="<?
echo HTMLSpecialChars($restname); ?>">
<!-- here it is important to escape the quote char (").
Every browser will get cracy, if you want to edit a string like
$restname="\"The White Horse\""; -->


Input description (you can use HTML - if you can):

<TEXTAREA NAME="descript"><?
echo HTMLSpecialChars($descript);
?></TEXTAREA>
<INPUT TYPE=submit>
</FORM>
</PRE>

Note, that the TEXTAREA includes <B>NO extra space, no newline or anything else</B>. If you do not so, you have programmed a HTML memory leak. :-) The $descript-string is growing between every submit and sends it back to the browser
and the browser will add new chars, cause your
TEXTAREA has told this to him.