I think it should be like this:
1 receive the text with BBCode.
2 text with BBCode is stored directly in the database.
----3.1 If you want to display, use a function that converts text with BBCode to HTML.
----3.2 If you want to edit, display the text with BBCode directly.
The main security aspect is to block HTML tags. How should this be blocked? is to add htmlspecialchars () directly at the first step of receiving it? Does this interfere with the function of converting text with BBCode to HTML?
There is also the NL2BR () function. What should be the order of use of the three functions mentioned earlier?
Is there any other place you need to be aware of?
Reply to discussion (solution)
Save As-is
BBCode decoding after htmlspecialchars of saved text is displayed
Save As-is
BBCode decoding after htmlspecialchars of saved text is displayed
NL2BR () 's location? When receiving, use textarea.
You may need to use NL2BR () only when displaying
To use, also after BBCode decoding
