note 48481 added to function.urldecode

A reminder: if you are considering using urldecode() on a $_GET variable, DON'T! Evil PHP: <?php # BAD CODE! DO NOT USE! $term = urldecode($_GET['sterm']); ?> Good PHP: <?php $term = $_GET['sterm']; ?> The webserver will arrange for $_GET to have been urldecoded once already by the time it reaches you! Using urldecode() on $_GET can lead to extreme badness, PARTICULARLY when you are assuming "magic quotes" on GET is protecting you against quoting. Hint: script.php?sterm=%2527 [...] PHP "receives" this as %27, which your urldecode() will convert to "'" (the singlequote). This may be CATASTROPHIC when injecting into SQL or some PHP functions relying on escaped quotes -- magic quotes rightly cannot detect this and will not protect you! This "common error" is one of the underlying causes of the Santy.A worm which affects phpBB < 2.0.11. ---- Manual Page -- http://www.php.net/manual/en/function.urldecode.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+48481 Delete -- http://master.php.net/manage/user-notes.php?action=delete+48481&report=yes Reason: bad code -- http://master.php.net/manage/user-notes.php?action=delete+48481&report=yes&reason=bad+code Reason: spam -- http://master.php.net/manage/user-notes.php?action=delete+48481&report=yes&reason=spam Reason: useless example -- http://master.php.net/manage/user-notes.php?action=delete+48481&report=yes&reason=useless+example Reason: contains commercial links -- http://master.php.net/manage/user-notes.php?action=delete+48481&report=yes&reason=contains+commercial+links Reason: useless note -- http://master.php.net/manage/user-notes.php?action=delete+48481&report=yes&reason=useless+note Reject -- http://master.php.net/manage/user-notes.php?action=reject+48481&report=yes Search -- http://master.php.net/manage/user-notes.php