PHP removing HTML from POST data

Remember that print_r()'s output will be viewed in the browser. Unless you take special steps to handle the HTML, the browser's going to see HTML and render it as such. Unless you view the source of the page, all you'll see is the text content.

To view the uploaded HTML directly, you'd have to run it through htmlentities()/htmlspecialchars() first, which'll encode any HTML metacharacters (e.g. > to >).

As well, unless you have a special need for it, there's no reason to retrieve form submission data from php://input. That's the raw data, and most likely you'd just be parseing it anyways, which PHP has already done for you with the _GET/_POST arrays. On top of that, if the submission includes a file upload, you'll be slurping that entire file into memory, which could very well exceed your script's memory_limit and kill things right there.

There's also a note in the I/O streams PHP man page that php://input can only be read once. If your script's doing it multiple times, the second and subsequent reads will get a null.

Are you using a Framework? Check nothing is iterating through the array beforehand ie.

foreach ($_POST as $key=>$val)
{
  $_POST[$key] = strip_tags($val);
}

also check you've not got any defunct mod_security rules enabled (http://www.modsecurity.org/) of course that depends on if you're using mod_sec!

try doing this

echo '<pre>';
print_r($_REQUEST);
echo '</pre>';

and

foreach ($_POST as $key=>$val)
{
  echo $key .' = '. htmlentities($val) . '<br />';

}

just to make double check you're not missing something :)

EDIT: try this:

foreach ($_REQUEST as $key=>$val)
{
  echo $key .' = '. htmlentities($val) . '<br />';

}