PHP nl2br posting duplicate <br/>'s? - php

Question

I'm using the following code to post the content of a text box to an HTML file. When the info is submitted, I want there to be <br/> inserted where line-breaks are. I thought using this code would fix the problem:
$content = nl2br($_POST['content']);
But it seems to produce the following if there is already a <br /> in place:
Lorum ipsum.<br /><br />
How do I remedy this?
The post code:
<?php
$fn = "people.html";
if (isset($_POST['content']))
{
$content = stripslashes('content');
$content = nl2br($_POST['content']);
$fp = fopen($fn,"w") or die ("Error opening file in write mode!");
fputs($fp,$content);
fclose($fp) or die ("Error closing file!");
}
?>
How it's being submitted:
<form action="<?php echo $_SERVER["PHP_SELF"] ?>" method="post">
<textarea rows="25" cols="40" name="content"><?php readfile($fn); ?></textarea>
<input type="submit" value="Sauver">
</form>

Answer 1

From what I understand, if the html your inserting already contains a <br /> tag then it adds two because of the \n after the <br />, to remedy this you would need to strip the extra break tag from the input using str_replace or regex.
Then when echoing result back to the textarea you should use: <?=htmlentities(file_get_contents($fn))?> as SpoonNZ suggested.
note: using user submitted html without passing through htmlentities or $_SERVER["PHP_SELF"] within a form will open you upto XSS

Answer 2

You should not be storing your line breaks as <br> in your persistent storage (your text file). In your text file, line breaks should be stored as line breaks ("\n"). You should only transform them into HTML <br> tags when you output them into HTML. You also need to escape any user supplied content you put into HTML (for why, read The Great Escapism).
if (!empty($_POST['content'])) {
file_put_contents('people.txt', $_POST['content']);
}
Then:
<textarea rows="25" cols="40" name="content"><?php
echo nl2br(htmlspecialchars(file_get_contents('people.txt')));
?></textarea>
This way line breaks are line breaks at all times, they just need to be converted to <br>s because that's the only way to conserve them in an HTML context.
As for why line breaks are doubling, there simply seems to be an additional line break added at some point, possibly by the browser when the textarea content is submitted. You may want to trim your input/output to avoid any leading or trailing whitespace.

Answer 3

//$content = stripslashes('content');
$content = preg_replace('~\s*<br ?/?>\s*~',"<br />",$_POST['content']);
$content = nl2br($content);
Something like that should strip excess whitespace around line breaks for you.
Also, why are you using stripslashes? That should only be necessary if you have magic quotes on, and you shouldn't have magic quotes on. You also have got that line's syntax wrong anyway.
edit: Still trying to interpret what you're saying. I'm thinking this might help:
<form action="<?php echo $_SERVER["PHP_SELF"] ?>" method="post">
<textarea rows="25" cols="40" name="content"><?htmlentities(preg_replace('~\s*<br ?/?>\s*~i',"\n",(file_get_content($fn))); ?></textarea>
<input type="submit" value="Sauver">
</form>'
Will start with the correct data. Perhaps.