& cut off in directory path - php

Question

I'm passing a folder name and path via a $_GET. All is fine until I pass a folder name containing and (&) ampersand then the folder name is cut short. i.e folder name test & replace is shorted to 'test '.
Have tried str_repalce, htmlentites, htmlspecialchars
$dir_path = $_GET['path'].$_GET['folder'];
The whole code:
<div class="panel-body" style="font-size:14px">
<?php
if(isset($_GET['path'])){
$dir_path = $_GET['path'].$_GET['folder']."/";
echo "full path = ".$dir_path."<br>folder = ".$Folder;
}else{
$dir_path = PUBLICPATH."/Folderholder/".$branch."/"; // branch url to that branchs folders and in $_GET['folder'];
}
//$dir = opendir($dir_path);
$mappath = str_replace(PUBLICPATH."/Folderholder/","",$dir_path);
echo "<p><i class='fa fa-sitemap'> <b>".$mappath."</b></i></p>\n"; ?>
<div class="row">
<div class="col-md-6">
<?php
echo "<button onclick='goBack()' class='btn btn-primary btn-sm'>Return</button><P>\n";
?>
</div>
<div class="col-md-6">
<?php
if(parent::$UM->get('Level') !== 'User' and $branch !== 'Main-Admin'){
echo "<a href='uploadfrm?path=".$dir_path."' class='btn btn-primary btn-sm'>Upload to this folder</a>";
}elseif(parent::$UM->get('Level') == 'Main-Admin'){
echo "<a href='uploadfrm?path=".$dir_path."' class='btn btn-primary btn-sm'>Upload to this folder</a>";
}
?>
</div>
</div>
<div class="row"><div class="col-md-12"> </div></div>
<table width="70%">
<?php
$files = scandir($dir_path);htmls
foreach ($files as $file)
{
if($file != "." && $file != "..")
{
echo "<tr>\n";
if(is_dir($dir_path.$file)){
echo "<td><i class='fa fa-folder'></i> <a href='".BASEURL."Folderholder/userdash?path=".$dir_path."&folder=".$file."'>$file</a></td>\n";
echo "<td> </td>\n";
}else{
echo "<td><i class='fa fa-download'></i> ".$file."</td>\n<td><a href='http://downloadfolder/download1.php?file=".$dir_path.$file."' target='_Blank'>Download</a></td>\n";
}//change path as required
echo "</tr>\n";
}
}
?>
</table>
</section>
</div>

Answer 1

The & character is used to separate key=value pairs in the query string.
When you generate the query string you should express it as an escape sequence: %26.
How you do that depends on how you are generating the query string in the first place.
You've tagged this php, but the PHP code you have shared is reading the data. You haven't shown us the code for generating it, but assuming that is still PHP:
To generate it in PHP you would normally use http_build_query:
$query = http_build_query(Array( path => "example&example", folder => "example&example" ));

Answer 2

urlencode should do the trick. It is specifically used for passing parameters to a URL to use as variables, as you are doing in your GETs.

Answer 3

Though previous answers in this thread are not incorrect, please also consider using rawurlencode as it will generate a more standards compliant (RFC 3986) URI. urlencode triggers the legacy encoding where spaces are replaced by plus-signs. (Anyone remember that?)

Answer 4

To stop the cut off of the folder name.
Two coding changes $dir_path = $_GET['path'].$_GET['folder']."/"; changed to
$dir_path = $_GET['path'].rawurldecode($_GET['folder'])."/";
and echo "<td><i class='fa fa-folder'></i> <a href='".BASEURL."Folderholder/userdash?path=".$dir_path."&folder=".$file."'>$file</a></td>\n";
changed to
echo "<td><i class='fa fa-folder'></i> <a href='".BASEURL."Folderholder/userdash?path=".$dir_path."&folder=".rawurlencode($file)."'>$file</a></td>\n";
<div class="panel-body" style="font-size:14px">
<?php
if(isset($_GET['path'])){
$dir_path = $_GET['path'].$_GET['folder']."/";
}else{
$dir_path = PUBLICPATH."/Folderholder/".$branch."/"; // branch url to that branchs folders and in $_GET['folder'];
}
//$dir = opendir($dir_path);
$mappath = str_replace(PUBLICPATH."/Folderholder/","",$dir_path);
echo "<p><i class='fa fa-sitemap'> <b>".$mappath."</b></i></p>\n"; ?>
<div class="row">
<div class="col-md-6">
<?php
echo "<button onclick='goBack()' class='btn btn-primary btn-sm'>Return</button><P>\n";
?>
</div>
<div class="col-md-6">
<?php
if(parent::$UM->get('Level') !== 'User' and $branch !== 'Main-Admin'){
echo "<a href='uploadfrm?path=".$dir_path."' class='btn btn-primary btn-sm'>Upload to this folder</a>";
}elseif(parent::$UM->get('Level') == 'Main-Admin'){
echo "<a href='uploadfrm?path=".$dir_path."' class='btn btn-primary btn-sm'>Upload to this folder</a>";
}
?>
</div>
</div>
<div class="row"><div class="col-md-12"> </div></div>
<table width="70%">
<?php
$files = scandir($dir_path);htmls
foreach ($files as $file)
{
if($file != "." && $file != "..")
{
echo "<tr>\n";
if(is_dir($dir_path.$file)){
echo "<td><i class='fa fa-folder'></i> <a href='".BASEURL."Folderholder/userdash?path=".$dir_path."&folder=".$file."'>$file</a></td>\n";
echo "<td> </td>\n";
}else{
echo "<td><i class='fa fa-download'></i> ".$file."</td>\n<td><a href='http://downloadfolder/download1.php?file=".$dir_path.$file."' target='_Blank'>Download</a></td>\n";
}//change path as required
echo "</tr>\n";
}
}
?>
</table>
</section>
</div>

Answer 5

Use urlencode to encode the url like:
$encodedURL = urlencode ('Your url');
Explanation: urlencode will encode the special characters to their entity values and than use it.