I am running PHP5 under Windows Server 2003 with SQL Server 2005 as my back-end database.
I have the PHP pages communicating successfully with the server when I do manual inserts, so I'm moving on to form data inserts and programmatic data pulls.
I have implemented FCKeditor as a GUI front-end for my users to see so they can format the data easily.
On the user's page they have two form fields, a text field for article title, and the FCKeditor window to enter their text. This is stored in a SQL Server table called testArticles.
To prevent injection attacks and problems with apostrophes I use this code for my insert statement:
function mssql_real_escape_string($
string) {
return str_replace("'", "''", $string);
}
$tValue = mssql_real_escape_string($
_POST['tit
le']);
$sValue = mssql_real_escape_string($
_POST['FCK
editor1'])
;
$query = "INSERT INTO testArticles (ArticleTitle, ArticleText) ";
$query .= "VALUES ('$tValue', '$sValue') ";
This is working very well for storing data of all sorts and pulling the data back out. However I wanted to test the limits so I did something a user might do--I copied a bunch of Excel data and pasted it in the editor window. It took a while but the editor sent the data to SQL Server and it stored correctly. The HTML is sort of dirty, but it took.
Now to the crux of my problem: When I pull the record it does not display properly. I took the contents of the cell and pasted it into an HTM document, and the entire contents display. However when I use this code:
<body>
<?php
//connection to the database
$dbhandle = mssql_connect($myServer, $myUser, $myPass)
or die("Couldn't connect to SQL Server on $myServer - error was " . msql_error() );
//select a database to work with
$selected = mssql_select_db($myDB, $dbhandle)
or die("Couldn't open database $myDB");
//declare the SQL statement that will query the database
$query = "SELECT ArticleTitle, ArticleText ";
$query .= "FROM testArticles ";
//execute the SQL query and return records
$result = mssql_query($query);
$numRows = mssql_num_rows($result);
echo "<h1>" . $numRows . " Row" . ($numRows == 1 ? "" : "s") . " Returned </h1>";
$rowNum = 0;
//display the results
while($row = mssql_fetch_array($result)
)
{
$rowNum++;
echo "<B>" . $row["ArticleTitle"] . "</B><P>" .
$row["ArticleText"] . "</li>";
}
//close the connection
mssql_close($dbhandle);
?>
</body>
It does not display the entire contents of the cell. In fact, some HTML tags (<tr style="height: 11.25pt) are visible in the output.
I cannot determine what would be different. Again, the contents of the cell work if saved to an HTML file, but they don't work when pulled using the above code.
Any suggestions?
Start Free Trial
