note 23292 deleted from function.urlencode by didou
| From: | didou@php.net | Date: | Thu, 29 May 2003 21:05:19 +0000 |
| Subject: | note 23292 deleted from function.urlencode by didou | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-49316@lists.php.net to get a copy of this message | ||
Note Submitter: mail-php<at>kimihia.org.nz
----
Your code suffers from a format string vulnerability.
Instead, try this:
$userinput = "foo & bar" ;
$searchtext = urlencode($userinput) ;
// $searchtext now = "foo %26 bar"
$format = '<a href="search.php?searchtext=%s&id=%s&src=%s">' ;
$url = sprintf($format, $searchtext, "123", "456");
NEVER let the user specify the format string for sprintf. It's alright in PHP where it
allocates enough memory, but in other languages you might not be so lucky.
You also had your quotes around the wrong way. Use double quotes around URLs.