Welcome to the Treehouse Community

Want to collaborate on code errors? Have bugs you need feedback on? Looking for an extra set of eyes on your latest project? Get support with fellow developers, designers, and programmers of all backgrounds and skill levels here with the Treehouse Community! While you're at it, check out some resources Treehouse students have shared here.

Looking to learn something new?

Treehouse offers a seven day free trial for new students. Get access to thousands of hours of content and join thousands of Treehouse students and alumni in the community today.

Start your free trial

PHP Enhancing a Simple PHP Application Integrating Validation Errors Escaping Output

Posted by MUZ140045 Tafadzwa Gumunyu
MUZ140045 Tafadzwa Gumunyu
13,202 Points

stage 1 challenge 1

The PHP file below includes another PHP file that retrieves information from an external source for a directory listing. The page is supposed to display two input fields and a textarea, but it contains some malicious code. Modify the PHP code below to escape the output and display the correct HTML elements on the screen.

views_listing_edit.php 
<html>
<body>
<?php
if ($_SERVER["REQUEST_METHOD"] == "POST") {
    $link = trim($_POST["link"]);
    $name = trim($_POST["name"]);
    $description = trim($_POST["description"]);
    }
?>
    <form method="post">
        <table>
            <tr>
                <th>
                    <label for="name">Name</label>
                </th>
                <td>
                    <input id="name" name="name" value="<?php if (isset($name)) { echo htmlspecialchars($name); } ?>">
                </td>
            </tr>
            <tr>
                <th>
                    <label for="Link">Link</label>
                </th>
                <td>
                    <input id="link" name="link" value="<?php if (isset($link)) { echo htmlspecialchars($link); } ?>">
                </td>
            </tr>
            <tr>
                <th>
                    <label for="Description">Description</label>
                </th>
                <td>
                    <textarea id="description" name="description"><?php if (isset($description)) { echo htmlspecialchars(description); } ?></textarea>
                </td>
            </tr>    
        </table>
        <input type="submit" value="Save">
    </form>

</body>
</html>

1 Answer

Rich Bagley
Rich Bagley
25,869 Points
Rich Bagley
Rich Bagley
25,869 Points

Hi,

You're just over thinking this one.

If we assume the code is clean and starting from what's already there you simply need to wrap the values in htmlspecialchars, e.g.

<?php echo htmlspecialchars($listing_description); ?>

There should be 3 instances.

-Rich