#39078 [Opn]: Plus sign in URL arg received as space

ID: 39078 User updated by: main at springtimesoftware dot com Reported By: main at springtimesoftware dot com Status: Open Bug Type: Feature/Change Request Operating System: Windows XP PHP Version: 5.1.6 New Comment: So, that's it? Just a few ignorant attempts to classify this feature request as Bogus, with no assignment to a developer to make this feature request happen? I'm disappointed. An option to process incoming URL args using rawurldecode instead of urldecode would benefit so many users! David Spector Previous Comments: ------------------------------------------------------------------------ [2006-10-07 22:53:52] main at springtimesoftware dot com I'm not sure I'm following you. Section "Reserved:" in RFC 1738 (at http://www.freesoft.org/CIE/RFC/1738/4.htm) states: ---- Thus, only alphanumerics, the special characters "$-_.+!*'(),", and reserved characters used for their reserved purposes may be used unencoded within a URL. ---- Since "+" is listed, I would expect that any agent that obeyed this RFC would transmit "+" unchanged. That means that Apache should transmit "+" unchanged to PHP. This is why I would be surprised to find that Apache is the cause of this problem. Indeed, if I browse (using IE 6.0) to a Web page that contains a call to phpinfo(), browsing using a URL that contains the argument "Arg=+%20", then phpinfo() reports that _SERVER["QUERY_STRING"] has the value "Arg=+%20". (I just did this, I'm not making this up.) This confirms that the plus sign is getting to PHP okay. So wouldn't you agree with me that Apache cannot be causing this problem? PHP must be using urldecode() when it parses the arguments into the $_GET array, yes? Otherwise, how would the plus sign in the argument become a space? David ------------------------------------------------------------------------ [2006-10-07 22:15:37] derick@php.net It's not hard to believe... it's what the RFC states: http://www.freesoft.org/CIE/RFC/1738/4.htm, read the section "unsafe". ------------------------------------------------------------------------ [2006-10-07 21:44:08] main at springtimesoftware dot com So you are saying that this problem is definitely in Apache, not in PHP? You are saying that Apache converts plus signs into spaces? Please confirm this, it is hard to believe. David ------------------------------------------------------------------------ [2006-10-07 21:39:53] tony2001@php.net PHP receives POST/GET data from Apache in decoded form, so if Javascript doesn't encode "+" sign, we can't fix it or even change it in anyway. ------------------------------------------------------------------------ [2006-10-07 21:02:10] main at springtimesoftware dot com Oops, I should have said that escape('+ ') gives '+%20'. On the PHP side, the "+" is considered an alias for " ", so the script sees " " (urldecode converts "+" into " " and "%20" into " "). I stand by the wording in the feature request. David ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/39078 -- Edit this bug report at http://bugs.php.net/?id=39078&edit=1