Welcome to the Treehouse Community

Want to collaborate on code errors? Have bugs you need feedback on? Looking for an extra set of eyes on your latest project? Get support with fellow developers, designers, and programmers of all backgrounds and skill levels here with the Treehouse Community! While you're at it, check out some resources Treehouse students have shared here.

Looking to learn something new?

Treehouse offers a seven day free trial for new students. Get access to thousands of hours of content and join thousands of Treehouse students and alumni in the community today.

Start your free trial

PHP Enhancing a Simple PHP Application Integrating Validation Errors Escaping Output

Posted by MUZ140045 Tafadzwa Gumunyu
MUZ140045 Tafadzwa Gumunyu
13,202 Points

stage 1 challenge 1

The PHP file below includes another PHP file that retrieves information from an external source for a directory listing. The page is supposed to display two input fields and a textarea, but it contains some malicious code. Modify the PHP code below to escape the output and display the correct HTML elements on the screen

views_listing_edit.php 
    $description = trim($_POST["description"]);
    }
?>
    <form method="post">
        <table>
            <tr>
                <th>
                    <label for="name">Name</label>
                </th>
                <td>
                    <input id="name" name="name" value="<?php if (isset($name)) { echo htmlspecialchars($name); } ?>">
                </td>
            </tr>
            <tr>
                <th>
                    <label for="Link">Link</label>
                </th>
                <td>
                    <input id="link" name="link" value="<?php if (isset($link)) { echo htmlspecialchars($link); } ?>">
                </td>
            </tr>
            <tr>
                <th>
                    <label for="Description">Description</label>
                </th>
                <td>
                    <textarea id="description" name="description"><?php if (isset($description)) { echo htmlspecialchars(description); } ?></textarea>
                </td>
            </tr>    
        </table>
        <input type="submit" value="Save">
    </form>

</body>
</html>

    PHP

3 Answers

Chris Shaw
Chris Shaw
26,676 Points
Chris Shaw
Chris Shaw
26,676 Points

Hi MUZ140045 gumunyu,

The code you have above is different from the challenge itself, you have the correct answer but the final code you should have is the below.

<?php require_once("controllers_listing.php"); ?><html>
<body>

    <h1>Edit Listing</h1>

    <form method="post">
        <table>
            <tr>
                <th>
                    <label for="name">Name</label>
                </th>
                <td>
                    <input id="name" name="name" value="<?php echo htmlspecialchars($listing_name); ?>">
                </td>
            </tr>
            <tr>
                <th>
                    <label for="Link">Link</label>
                </th>
                <td>
                    <input id="link" name="link" value="<?php echo htmlspecialchars($listing_link); ?>">
                </td>
            </tr>
            <tr>
                <th>
                    <label for="Description">Description</label>
                </th>
                <td>
                    <textarea id="description" name="description"><?php echo htmlspecialchars($listing_description); ?></textarea>
                </td>
            </tr>    
        </table>
        <input type="submit" value="Save">
    </form>

</body>
</html>

Happy coding!

Masango Dewheretsoko
Masango Dewheretsoko
19,661 Points
Masango Dewheretsoko
Masango Dewheretsoko
19,661 Points

Hie the correct answer is as follows from Masango Dewheretsoko :

<?php require_once("controllers_listing.php"); ?><html> <body>

<h1>Edit Listing</h1>

<form method="post">
    <table>
        <tr>
            <th>
                <label for="name">Name</label>
            </th>
            <td>
                <input id="name" name="name" value="<?php echo htmlspecialchars($listing_name); ?>">
            </td>
        </tr>
        <tr>
            <th>
                <label for="Link">Link</label>
            </th>
            <td>
                <input id="link" name="link" value="<?php echo htmlspecialchars($listing_link); ?>">
            </td>
        </tr>
        <tr>
            <th>
                <label for="Description">Description</label>
            </th>
            <td>
                <textarea id="description" name="description"><?php echo htmlspecialchars($listing_description); ?></textarea>
            </td>
        </tr>    
    </table>
    <input type="submit" value="Save">
</form>

</body> </html> Happy coding!

Cristian Opran
Cristian Opran
6,963 Points
Cristian Opran
Cristian Opran
6,963 Points

thank you !