Re: PHP and RFC1866 (Ampersands in URI

-----Original Message----- From: Rasmus Lerdorf <rasmus@lerdorf.on.ca> To: James Turinsky <turinsky@WomensMusicNews.com> Cc: php-dev@lists.php.net <php-dev@lists.php.net> Date: Saturday, November 06, 1999 12:19 AM Subject: Re: [PHP-DEV] PHP and RFC1866 (Ampersands in URI Yeah, you are right that the current convention of using a '&' is not 100% compliant. However, PHP didn't establish this convention, we just support it. We also support an 'arg_separator' setting in the php3.ini file that can be set to ';' if that is what you prefer to use. So it is also the author's responsibility in PHP to pick the separator. PHP just defaults to '&'. -Rasmus ----end original message---- Ah, so there is a way to set a different separator. Thanks for the quick reply. > [Note: I am not on the list, e-mail me direct please.] > > I got myself in a DSW on who is "right" and who is "wrong" involving the use > of ampersand (&) in URIs, URLs, CGI, and scripting languages in general. > > Basically, reading the appropriate RFCs and other documented standards, I > see the following: > > Footnote 26 of RFC 1866: > > "The URI from a query form submission can be used in a normal anchor style > hyperlink. Unfortunately, the use of the `&' character to separate form > fields interacts with its use in SGML attribute values as an entity > reference delimiter. For example, the URI > `http://host/?x=1&y=2' must be > written <a > href="http://host/?x=1&#38;y=2"' or > <a > href="http://host/?x=1&amp;y=2">'. HTTP > server implementors, and in > particular, CGI implementors are encouraged to support the use of `;' in > place of &' to save users the trouble of escaping > &' characters this way." > > In other words, in order to be 100%, exactly correct HTML, you can not have > links in the form of: > > http://host/form.php3?x=1&y=2 > > because 1) it violates the standard (well, duh), 2) you really can't put > that "100% valid HTML 4.0" button on your page and 3) in real life, now > certain browsers are becoming (pick your terms: picky, stupid, pedantic, > correct, buggy) and are now starting to read &something as character > entities. So you have > http://host/form.php3?x=1&current=yes is starting to > be read by browsers as > http://host/form.php3?x=1&¤t=yes and sent back to the > server as such > (resulting in a "WTF?" from the server/CGI/program/script, not to mention > the user). > > The option that was suggested is to replace "&" with "&amp;" in all > links so > as to pass HTML validation, and be read by the browser and sent back with > "&" in place of "&amp;". Of course, this means two things: > > 1) escaping every occurance of "&" in a URL to be "&amp;" or the > numeric > version, which is of course, a PITA > 2) breaking whatever browsers that won't translate "&amp;" to > "&" or > otherwise screw it up. > > The other option, and why I'm even bothering with this, is to use a > different character to separate form fields, such as ";" or "|". Now, is > using a different character a problem of: > > 1) the PHP code/core/module (server-side)? > AND/OR > 2) the PHP page (page/site/script author)? > > I know with Perl that the author is responsible for separation of form > fields, at least in the things I've seen. However, I pointed this out to a > person developing in PHP, and they thought that the PHP core/code is > responsible for separating form fields, and not the page/script. Of course, > the other thing to note is that links in the appropriate form should be > passed back to the browser after processing too, so everything going in and > coming out is compliant. > > The only thing I currently know about PHP is how to get it to compile into > Apache 1.3.9, which is why I came here to get an answer. > > Thanks for your time. > > JT > > > > -- > PHP Development Mailing List <http://www.php.net/> > To unsubscribe, e-mail: php-dev-unsubscribe@lists.php.net > For additional commands, e-mail: php-dev-help@lists.php.net > To contact the list administrators, e-mail: php-list-admin@lists.php.net > > >