Allowing spaces in text input - php

Question

I've created a PHP blog system. Here's what the 'create a post feature' looks like
Here's the code for it:
<?php
session_start();
include('db_connect.php');
if(!isset($_SESSION['user_id'])){
header('Location: login.php');
exit();
}
if(isset($_POST['submit'])){
$title = $_POST['title'];
$body = $_POST['body'];
$category = $_POST['category'];
$title = $db->real_escape_string($title);
$body = $db->real_escape_string($body);
$user_id = $_SESSION['user_id'];
$date = date('Y-m-d G:i:s');
$body = htmlentities($body);
if($title && $body && $category){
$query = $db->query("INSERT INTO posts (user_id, title, body, category_id, posted) VALUES('$user_id', '$title', '$body', '$category', '$date')");
if($query){
echo '<div style="position:absolute; bottom: 40px; left: 500px; padding: 10px; background: red; box-shadow: 0px 3px 12px 2px #000; color: #fff;">Post Added</div>';
}else{
echo '<div style="position:absolute; bottom: 40px; left: 500px; padding: 10px; background: red; box-shadow: 0px 3px 12px 2px #000; color: #fff;">An unexpected error has occured.</div>';
}
}else{
echo '<div style="position:absolute; bottom: 40px; left: 500px; padding: 10px; background: red; box-shadow: 0px 3px 12px 2px #000; color: #fff;">Please enter all the required information to proceed</div>';
}
}
?>
<div id="mainbox">
<form action="<?php echo $_SERVER['PHP_SELF']?>" method="post">
<input type="text" name="title" placeholder="Enter Post Title Here">
<p></p>
<textarea name="body" cols=50 rows=10 placeholder="Enter Post Content Here"></textarea>
<p></p>
<select name="category">
<?php
$query = $db->query("SELECT * FROM categories");
while($row = $query->fetch_object()){
echo "<option value='".$row->category_id."'>".$row->category."</option>";
}
?>
</select>
<p></p>
<input type="submit" name="submit" value="Submit">
</form>
</div>
When I click submit hover and the post is created, it turns out like this:
As you can see, the paragraphs I added in have been removed. How do I prevent this and keep the paragraphs?

Answer 1

The way the data is entered is with new line characters. When this is pasted in an HTML page though, they are not visible because whitespace is collapsed in HTML. To keep the line breaks, convert them to HTML with nl2br().
Note that it is better to convert the data each time you print it out, not store it in the database with <br> tags. Otherwise if you go to edit the post, suddenly you're dealing with HTML and not plain text - not something users expect. Not only that, but you would be exposing yourself to security risks by allowing arbitrary HTML.
So on that example page, do something like this:
<?php
while($query->fetch()):
$html_body = nl2br($body);
$lastspace = strrpos($html_body, ' ');
?>
<h2><?php echo $title?></h2>
<p><?php echo substr($html_body, 0, $lastspace)."<a href='blog/post.php?id=$post_id'>..</a>"?></p>
<p>Category: <?php echo $category?>
<hr />
<p></p>
<?php endwhile?>

Answer 2

use htmlentities in php
or html pre tab
updated
echo "<pre>" . $postedData . "</pre>";
or
echo htmlentities($postedData);