note 23292 added to function.urlencode

Your code suffers from a format string vulnerability. Instead, try this: $userinput = "foo & bar" ; $searchtext = urlencode($userinput) ; // $searchtext now = "foo %26 bar" $format = '<a href="search.php?searchtext=%s&id=%s&src=%s">' ; $url = sprintf($format, $searchtext, "123", "456"); NEVER let the user specify the format string for sprintf. It's alright in PHP where it allocates enough memory, but in other languages you might not be so lucky. You also had your quotes around the wrong way. Use double quotes around URLs. -- http://www.php.net/manual/en/function.urlencode.php http://master.php.net/manage/user-notes.php?action=edit+23292 http://master.php.net/manage/user-notes.php?action=delete+23292 http://master.php.net/manage/user-notes.php?action=reject+23292