Consider the use of rawurldecode() on $_GET and $_REQUEST instead of urldecode()
| From: | Tig | Date: | Mon, 25 Jul 2011 03:56:29 +0000 |
| Subject: | Consider the use of rawurldecode() on $_GET and $_REQUEST instead of urldecode() | ||
| Groups: | php.internals | ||
| Request: | Send a blank email to internals+get-54183@lists.php.net to get a copy of this message | ||
Current the following string (inside the quotes) "give me a + plz"
should be encoded correctly to "give%20me%20a%20+%20plz" when passed
as a query string.
Now when the query string is presented with $_GET['x'], the result is
"give me a plz". Clearly wrong.
This leads to people (I'm sure I'm not the only one) using crazy hacks
to get something as simple as a query string var.
rawurlencode('give me a + plz') will produce "give%20me%20a%20%2B%20plz"
which is not "give%20me%20a%20+%20plz", but does not 'drop' the "+"
when
someone types in the query string.
The following code can be used to show the error (lines may wrap):
<?php
$str = 'give me a + plz';
echo '
<a href="'.$_SERVER['SCRIPT_NAME'].'?qs='.$str.'">As
typed by someone</a><br />
<a
href="'.$_SERVER['SCRIPT_NAME'].'?qs='.urlencode($str).'">With
urlencode()</a><br />
<a
href="'.$_SERVER['SCRIPT_NAME'].'?qs='.rawurlencode($str).'">With
rawurlencode()</a><br />
';
if ($_GET['qs']) {
echo '<p>Results:<br />
'.$_SERVER['QUERY_STRING'].' < $_SERVER[QUERY_STRING]<br />
'.$_GET['qs'].' < $_GET[qs]<br />
'.urldecode($_SERVER['QUERY_STRING']).' <
urldecode($_SERVER[QUERY_STRING])<br />
'.rawurldecode($_SERVER['QUERY_STRING']).' <
rawurldecode($_SERVER[QUERY_STRING])
</p>';
// code to break up the query string because _GET[] is not
// correct - NOT 100% reliable as well!!
$tmp = explode('&',$_SERVER['QUERY_STRING']);
foreach($tmp as $q) {
$qs = explode('=',$q);
for($i = 0; $i < count($qs) ; $i++) {
$real_GET[$qs[$i]] = rawurldecode($qs[++$i]);
}
} // foreach
echo '<p>
What was really passed?? Impossible to tell for sure but less likely to
be what _GET has:<br />'.$real_GET['qs'].'
</p>';
} // _GET[qs]
?>