Member Avatar for Red Dragon

Hi, I have a form which saves a string of text to a database with rawurlencode() which adds things like space characters (%20) and newline characters (%0D%0A), however, when I use rawurldecode() on this string it only decodes the space characters, and ignores all the newlines, by simply printing them also as spaces.

If there's another way to ensure new paragraph lines are printed correctly I'm all ears but I've spent the last hour or two asking/googling and have found no workable solution, I've also played around with str_replace() and nl2br() to no avail.

  • 2 Contributors
  • 5 Replies
  • 614 Views
  • 18 Hours Discussion Span
  • Latest Post Latest Post by Member #120589

Dani AI

Generated

Short version: the URL-decoding was fine — the browser is. The percent-encoded CRLF sequences decode back into carriage-return / line-feed characters, but HTML collapses those into spaces unless you convert them into HTML line breaks or preserve whitespace with CSS. saved the encoded text and observed spaces instead of visible new paragraphs; pointed to converting newlines for output, which is exactly why that fixed it.

Notes and practical advice:

  • Preserve security: always HTML-escape user text before you turn newlines into visible breaks, otherwise a user could inject markup or scripts. Escape first, then make newlines visible (or use a rendering mode that preserves whitespace safely).
  • Ways to show the original paragraphing: convert newline characters to HTML line breaks, wrap the text in an element that uses CSS like white-space: pre-wrap, or render the content inside a preformatted block if that suits the UX. Any of these will stop the browser from collapsing CRLF into single spaces.
  • Storage best practice: do not store user text URL-encoded unless you have a specific URL-related reason. Store raw text in a TEXT column and use parameterized queries. Encode or escape at the moment of output for the target format (HTML, JSON, URL), not at the moment of storage.

Troubleshooting checklist:

  • Inspect the raw DB value to verify it actually contains %0D%0A (or the decoded CR/LF) and that you are decoding the same string you stored.
  • Normalize newline types if needed (CRLF vs LF) so presentation is consistent across platforms.
  • Check for double-encoding/decoding cycles which can corrupt whitespace.
  • If you want to allow limited HTML or Markdown, use a vetted sanitizer or renderer rather than echoing raw HTML.

This preserves the original input formatting while avoiding XSS and long-term fragility of storing encoded strings.

Recommended Answers

All 5 Replies

Member Avatar for Member #120589

Newlines do not print if you echo them directly to the screen. Can't you pass this via form/post - does it have to be via url/get?

Member Avatar for Red Dragon

it's directly from a mysql_query

$fetch_news = mysql_query("SELECT id, post_user, post_date, post_msg FROM news ORDER BY id DESC") or die(mysql_error());
while ($row = mysql_fetch_array($fetch_news)) { echo rawurldecode($row[3]); }

I've also tried:

str_replace("%0D%0A", "\r\n", $row[3]); // for newlines

And:

str_replace("%20", " ", $row[3]); // for spaces

They work seperately, but I need them to work at the same time, also I don't feel like doing a str_replace() for EVERY possible ASCII character when I would've thought rawurldecode() should handle it by itself.

Member Avatar for Member #120589

They work seperately, but I need them to work at the same time, also I don't feel like doing a str_replace() for EVERY possible ASCII character when I would've thought rawurldecode() should handle it by itself.

Have you tried running

$output = nl2br(rawurldecode($str));

I don't understand why you're saving these strings in encoded form in the DB. It just seems a little awkward to me. If you really have to pass data via querystring, which I don't quite understand, you could do the decode prior to storing?

Member Avatar for Red Dragon

that worked great thanks diafol, it's encoded for storing to that spaces/newlines etc are saved as they should be (rather than just one long line). i was just struggling to get the output the same as the input

Member Avatar for Member #120589

Ok, we solved?

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.