problem with get_option in dashboard

Question

I have created simple plugin which transfer the html code from text-area in dashboard to front-end page where function defined in the plugin is being called to render the front page. However i have problem with reading the option. i.e. .Saving works ok, but reading do problems.

the example code for the field to be saved and read.

<textarea name="bn_notice_F" type="text"
    value="<?php echo get_option('bn_notice_F'); ?>" ><?php
    echo get_option('bn_notice_F');
?></textarea> 

Saving the option works, but when I read get_option the function adds some text, eliminates the html marks etc.

For example when saving:

<iframe width="560" height="315"
    src="https://www.youtube.com/embed/rlZRtQkfK04"
    frameborder="0" allowfullscreen></iframe>

It saves correctly, but when displaying on the dashboard I get:

</iframe>" ><iframe width="560" height="315" src="https://www.youtube.com/embed/rlZRtQkfK04" frameborder="0" allowfullscreen></iframe>

any clue why? is there any sanitizing or sth similar ? if so how to to pass and save raw text from text-area , and read to text-area raw code?

thank you for help

UPDATE The plugin is set as

add_submenu_page('options-general.php', __('b_Notice'), __('b_Notice'), 'delete_plugins', 'b-notice', array($this, 'settingsPage'));

and there is form to save and read text for options.

Then i have form code

<form method="post" action="options.php">
            <?php settings_fields('bn'); ?>
            <?php do_settings_sections('bn'); ?>
             <label for="bn_enabled_S1">Side Notice</label>             
             <input type="checkbox" name="bn_enabled_S1" value="1" <?php checked( '1', get_option( 'bn_enabled_S1' ) ); ?> />           
             <textarea name="bn_notice_S1" type="text" value="<?php echo get_option('bn_notice_S1'); ?>" ><?php echo get_option('bn_notice_S1')?></textarea> 
            <?php submit_button(); ?>            
    </form>

and then the function

 public function settings(){
    register_setting('bn', 'bn_enabled_F');
    register_setting('bn', 'bn_notice_F');
}

Thank you for looking at code.

Answer 1

The problem is your value="" attribute, for example <textarea value="<iframe>"> is invalid HTML, and the browser will do its best to try and fix the markup. That's why you're getting strange results

So instead, remove the value attribute. You'll also want to escape with esc_textarea to prevent malicious code breaking out of the text area