如何发布脚本mysql [重复]

Question

This question already has an answer here:

• How to insert a php code snippet in mysql database 3 answers

if i post a script with my cms people can not read it, it goes into the database as text

like this:

<script>
            // Source: http://www.backalleycoder.com/2011/03/20/link-tag-css-stylesheet-load-event/
            var loadCSS = function(url, callback){
                var link = document.createElement('link');
                link.type = 'text/css';
                link.rel = 'stylesheet';
                link.href = url;
                link.id = 'theme-style';

                document.getElementsByTagName('head')[0].appendChild(link);

                var img = document.createElement('img');
                img.onerror = function(){
                    if(callback) callback(link);
                }
                img.src = url;
            }

            $(document).ready(function() {
                var initEditor = function() {
                    $("textarea").sceditor({
                        plugins: 'bbcode',
                        style: "./minified/jquery.sceditor.default.min.css"
                    });
                };

                $("#theme").change(function() {
                    var theme = "./minified/themes/" + $(this).val() + ".min.css";

                    $("textarea").sceditor("instance").destroy();
                    $("link:first").remove();
                    $("#theme-style").remove();

                    loadCSS(theme, initEditor);
                });

                initEditor();
            });
        </script>

But how kan i make it that it can be read on the website?

I use this mysql query:

INSERT INTO categorie (title, longstory, shortstory, date, author, categorie, type,img) VALUES('{$title}','" . htmlspecialchars_decode($longstory) . "','{$shortstory}','" . time() . "','". $_SESSION['user']['username'] ."','{$categorie}','{$type}','{$img}')";

I use to post a script: " . htmlspecialchars_decode($longstory) . "

</div>

Answer 1

To escape database (string/text) input use mysql(i)_real_escape_string.

htmlspecialchars use on output, when you put this code to your site.