Storing HTML in a database

[Aso]

Just having a flick through a Wordpress database, it seems they store the post content with certain markup (such as <b>, <em>, <img> tags etc.) but not <p> (paragraph) tags, instead inserting these at 'runtime' with the use of PHP.

However, I've seen other CMS's simply store the complete HTML in the DB, then just output the chunk when required.

Is there any advantage of either? Surely the latter would save a little processing power?

Another Q - is it common to protect against (SQL) injection when you know the input is coming from an authenticated user? Say, when a logged in author is adding content to the DB? How would you do this if you need to preserve HTML tags?

Cheers for any advice

[CloudedVision]

It seems to me that saving the complete HTML code will save processing power and such, I don't know why wordpress would save it without the <p> tags.

Actually, protecting against SQL injection is only half of it. You also need to protect against the user causing an SQL error because the close out the single quotes too early. So, yes it is common to do that.

[Aso]

Actually, protecting against SQL injection is only half of it. You also need to protect against the user causing an SQL error because the close out the single quotes too early. So, yes it is common to do that.

What's the best method for doing so? (I can't believe I didn't think of the user causing errors without intent!)

[CloudedVision]

It depends. If magic_quotes is on, you don't need to do anything. (I usually insert a line in the script to turn it off, it can mess quite a lot of things up) If its off, mysql_escape_string() works nicely.

Just out of curiousity, whats this big project you seem to be doing? A CMS or something of the like?

[Aso]

Originally Posted by CloudedVision

If magic_quotes is on, you don't need to do anything. (I usually insert a line in the script to turn it off, it can mess quite a lot of things up) If its off, mysql_escape_string() works nicely.

Cheers for the tip CV

Just wondered if mysql_escape_string was sufficient - having looked it up, the function's now deprecated and mysql_real_escape_string should be used instead.

Originally Posted by CloudedVision

Just out of curiousity, whats this big project you seem to be doing? A CMS or something of the like?

Aha! Yes, this is quite new to me (I've worked with open-source kits before, but never really tackled the DB side of things head on).

For this project (a bathroom showcase site) I really needed something quite specific and dead simple

Luckily I've also got Mr Ullman's 'PHP and MySQL for Dynamic Websites' SE which has really helped me out, but it's not quite the same as some dedicated advice @ WF

[CloudedVision]

Originally Posted by Aso

Just wondered if mysql_escape_string was sufficient - having looked it up, the function's now deprecated and mysql_real_escape_string should be used instead.

shoot. I knew it contained the word "real" in it.

thanks for the correction