PHP and RFC1866 (Ampersands in URI
| From: | James Turinsky | Date: | Sat, 06 Nov 1999 05:14:52 +0000 |
| Subject: | PHP and RFC1866 (Ampersands in URI | ||
| Groups: | php.dev | ||
| Request: | Send a blank email to php-dev+get-12162@lists.php.net to get a copy of this message | ||
[Note: I am not on the list, e-mail me direct please.]
I got myself in a DSW on who is "right" and who is "wrong" involving the use
of ampersand (&) in URIs, URLs, CGI, and scripting languages in general.
Basically, reading the appropriate RFCs and other documented standards, I
see the following:
Footnote 26 of RFC 1866:
"The URI from a query form submission can be used in a normal anchor style
hyperlink. Unfortunately, the use of the `&' character to separate form
fields interacts with its use in SGML attribute values as an entity
reference delimiter. For example, the URI `http://host/?x=1&y=2' must be
written
<a href="http://host/?x=1&y=2"' or
<a
href="http://host/?x=1&y=2">'. HTTP
server implementors, and in
particular, CGI implementors are encouraged to support the use of `;' in
place of &' to save users the trouble of escaping &' characters this
way."
In other words, in order to be 100%, exactly correct HTML, you can not have
links in the form of:
http://host/form.php3?x=1&y=2
because 1) it violates the standard (well, duh), 2) you really can't put
that "100% valid HTML 4.0" button on your page and 3) in real life, now
certain browsers are becoming (pick your terms: picky, stupid, pedantic,
correct, buggy) and are now starting to read &something as character
entities. So you have http://host/form.php3?x=1¤t=yes is
starting to
be read by browsers as
http://host/form.php3?x=1&¤t=yes and sent
back to the server as such
(resulting in a "WTF?" from the server/CGI/program/script, not to mention
the user).
The option that was suggested is to replace "&" with "&" in all
links so
as to pass HTML validation, and be read by the browser and sent back with
"&" in place of "&". Of course, this means two things:
1) escaping every occurance of "&" in a URL to be "&" or the numeric
version, which is of course, a PITA
2) breaking whatever browsers that won't translate "&" to "&"
or
otherwise screw it up.
The other option, and why I'm even bothering with this, is to use a
different character to separate form fields, such as ";" or "|". Now, is
using a different character a problem of:
1) the PHP code/core/module (server-side)?
AND/OR
2) the PHP page (page/site/script author)?
I know with Perl that the author is responsible for separation of form
fields, at least in the things I've seen. However, I pointed this out to a
person developing in PHP, and they thought that the PHP core/code is
responsible for separating form fields, and not the page/script. Of course,
the other thing to note is that links in the appropriate form should be
passed back to the browser after processing too, so everything going in and
coming out is compliant.
The only thing I currently know about PHP is how to get it to compile into
Apache 1.3.9, which is why I came here to get an answer.
Thanks for your time.
JT