note 50527 added to function.urlencode

I don't see why Example 2 recommends htmlentities(urlencode($data)). Since urlencode() already converts the non-alphanumeric characters to hexadecimal, htmlentities() would have nothing left to convert. On the other hand, I can understand using something like this: <?php $url = 'mycgi?foo1=' . urlencode($userinput1) . '&foo2=' . urlencode($userinput2); echo '<a href="' . htmlentities($url) . '">'; ?> I.e. urlencode() the individual pieces of data, then run the whole url thru htmlentities() to convert the & that separates the form variables into &amp;. A great see-also is http_build_query() (which is available in the PEAR package PHP_Compat for those of us who haven't gone to PHP5 yet). It does the urlencode for you, but you would still want to do the htmlentities on the url after it is built. ---- Manual Page -- http://www.php.net/manual/en/function.urlencode.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+50527 Delete: added to the manual -- http://master.php.net/manage/user-notes.php?action=delete+50527&report=yes&reason=added+to+the+manual Delete: bad code -- http://master.php.net/manage/user-notes.php?action=delete+50527&report=yes&reason=bad+code Delete: spam -- http://master.php.net/manage/user-notes.php?action=delete+50527&report=yes&reason=spam Delete: useless -- http://master.php.net/manage/user-notes.php?action=delete+50527&report=yes&reason=useless Delete: other reasons -- http://master.php.net/manage/user-notes.php?action=delete+50527&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+50527&report=yes Search -- http://master.php.net/manage/user-notes.php