PHP and RFC1866 (Ampersands in URI

From: Date: Sat, 06 Nov 1999 05:14:52 +0000
Subject: PHP and RFC1866 (Ampersands in URI
Groups: php.dev 
Request: Send a blank email to php-dev+get-12162@lists.php.net to get a copy of this message
[Note: I am not on the list, e-mail me direct please.] I got myself in a DSW on who is "right" and who is "wrong" involving the use of ampersand (&) in URIs, URLs, CGI, and scripting languages in general. Basically, reading the appropriate RFCs and other documented standards, I see the following: Footnote 26 of RFC 1866: "The URI from a query form submission can be used in a normal anchor style hyperlink. Unfortunately, the use of the `&' character to separate form fields interacts with its use in SGML attribute values as an entity reference delimiter. For example, the URI `http://host/?x=1&y=2' must be written <a href="http://host/?x=1&#38;y=2"' or <a href="http://host/?x=1&amp;y=2">'. HTTP server implementors, and in particular, CGI implementors are encouraged to support the use of `;' in place of &' to save users the trouble of escaping &' characters this way." In other words, in order to be 100%, exactly correct HTML, you can not have links in the form of: http://host/form.php3?x=1&y=2 because 1) it violates the standard (well, duh), 2) you really can't put that "100% valid HTML 4.0" button on your page and 3) in real life, now certain browsers are becoming (pick your terms: picky, stupid, pedantic, correct, buggy) and are now starting to read &something as character entities. So you have http://host/form.php3?x=1&current=yes is starting to be read by browsers as http://host/form.php3?x=1&¤t=yes and sent back to the server as such (resulting in a "WTF?" from the server/CGI/program/script, not to mention the user). The option that was suggested is to replace "&" with "&amp;" in all links so as to pass HTML validation, and be read by the browser and sent back with "&" in place of "&amp;". Of course, this means two things: 1) escaping every occurance of "&" in a URL to be "&amp;" or the numeric version, which is of course, a PITA 2) breaking whatever browsers that won't translate "&amp;" to "&" or otherwise screw it up. The other option, and why I'm even bothering with this, is to use a different character to separate form fields, such as ";" or "|". Now, is using a different character a problem of: 1) the PHP code/core/module (server-side)? AND/OR 2) the PHP page (page/site/script author)? I know with Perl that the author is responsible for separation of form fields, at least in the things I've seen. However, I pointed this out to a person developing in PHP, and they thought that the PHP core/code is responsible for separating form fields, and not the page/script. Of course, the other thing to note is that links in the appropriate form should be passed back to the browser after processing too, so everything going in and coming out is compliant. The only thing I currently know about PHP is how to get it to compile into Apache 1.3.9, which is why I came here to get an answer. Thanks for your time. JT

« previous php.dev (#12162) next »