Search the Community

I have a contact form on my site. I'm using the book's methods to validate POST data from a textarea input field called "contact_info". if ($_SERVER['REQUEST_METHOD'] == 'POST') { ... if (empty($_POST['contact_info'])) { $contact_errors['contact_info'] = 'Please enter a comment.'; } elseif (preg_match('/^[A-Za-z0-9.,-$?!]*$/', $_POST['contact_info'])) { $_POST['contact_info'] = str_replace(' ','',$_POST['contact_info']); //remove all spaces $_POST['contact_info'] = trim($_POST['contact_info']); //remove any space before or after any characters $_POST['contact_info'] = escape_data($_POST['contact_info'], $dbc); // add htmlspecialchars ??? // anything else ??? } else { $contact_errors['contact_info'] = 'Your comment contains inappropriate characters. Allowable characters include letters a to z, letters A to Z, numbers 0 to 9, as well as, period, comma, exclamation mark, question mark, dollar sign and hyphen.'; } ... } <form method="post" accept-charset="utf-8"> ... <?php create_contact_form_input('contact_info', 'textarea', $contact_errors); ?> ... </form> What is the most secure way to validate user input from a textarea field?

I have a textarea in a form to collect user message to a database. When the entry is stored to database all html tags are converted into text. Users can include any number of URLs in the message. With my current settings all the URLs will be printed on the webpage as static character strings (i.e., they are not "clickable."). I wonder how I could make those URLs become clickable links when the message is retrieved from database and printed on a webpage, using purely PHP coding?