htmlspecialchars + htmlentities not working - php

I'm setting up pagination on a search page and trying to the search query to each number.
href="?s=search+term"
The problem is when a user enters special characters such as #, it will comment out anything behind it.
Normally I use htmlentities to turn it into %23 however it is not working in this situation.
Keep in mind that the first time it searchs it looks like this in the search query
href="?s=%23+search+term"
and upon clicking a page number the search query then looks like this
href="?s=#%20search%20term"
Which, when executed by php, is commented out. Any ideas on how to bypass this?

You'll need to use urlencode() on the search term to properly encode it for use in a url.
http://php.net/manual/en/function.urlencode.php
As a better option, you can generate the entire querystring from an array using http_build_query():
$params = [
's' => "my search term",
'p' => "3"
];
echo http_build_query($params); // will echo a properly encoded querystring

Related

php string not usable in method file_get_contents($var)

I have a method that scrapes data from a url and returns that as a string variable. Currently the method is working if i put in my own url, but when i insert a generated url it doesnt work.
e.g.
The following string is working if I insert it into a variable, and pass it:
http://www.rijkswaterstaat.nl/apps/geoservices/rwsnl/awd.php?mode=html&projecttype=windsnelheden_en_windstoten&category=1&loc=ZBWI&net=LMW
But this string is being generated by another source. The result of my attempt to fetch it is (var_dump()):
string(154) "http://www.rijkswaterstaat.nl/apps/geoservices/rwsnl/awd.php?mode=html&projecttype=windsnelheden_en_windstoten&category=1&loc=ZBWI&net=LMW"
The string is only 138 characters, however it prints string(158). I think this has something to do with the fact it is not working, but i'm not even sure...
Does anyone have any idea how to clean this up? I have found other questions with the question why var_dump() is showing another value then the length of the string, and that had something to do with unvisible characters, but no real solution is given anywhere.
Thx
154-138 = 16
You have 4 & in the string
& HTML encoded is &
So your string seems to be HTML encoded - in the browser you don't see the encoding unless you "View Source".
You can use html_entity_decode() to decode the string or, if possible, make sure that you get a string that is not encoded for HTML output in the first place.

PayPal is Truncating My Return Query String

When connecting to PayPal I use a URL like this (I am using fake values here, but the structure is real):
https://www.paypal.com/cgi-bin/webscr?&business=ZDS346347&cmd=_xclick&amount=100&item_name=Test&no_note=1&no_shipping=1&rm=2&return=http://www.website.com/registration.php?paypal=1&classid=122&sessionid=264&studentid=2286
The problem is when I send this url, it truncates my return value query string from this:
paypal=1&classid=122&sessionid=264&studentid=2286
to this:
paypal=1
The ampersands in the return value are confusing it, but I need to use them so I can process those query string values on the return.
Is there someway, I can pass that whole return string to PayPal so it won't truncate after the first ampersand it hits.
Thanks,
Chris
Wrap the passed URL with urlencode to turn the ampersands into PayPal-parsable characters, then when your URL gets called use urldecode to decode them.
This happens because PayPal's URL simply splits everything after the ? into chunks by the & symbol. It doesn't know when one is part of your website or not. So it's sending PayPal classid=122 as it's own key/value pair, not as a part of your URL. Encoding the URL this way should make it work correctly.
edit Referenced the wrong PHP functions. urlencode/decode are for GET parameter passing, htmlspecialchars is for storing HTML data

Remove %20 from PHP header redirect using query string

I have a form I'm trying to submit to a database. Upon successful submission I would like the page to redirect to a page containing the submitted data. I'm doing this with a query string like:
header("location:palette.php?colID=$title");
Which is producing a URL like: palette.php?colID=Funky%20Colours
Is it possible for the PHP header redirect to redirect to a query like:
palette.php?colID=Funky-Colours
To produce a URL like: palette.php?colID=Funky-Colours
If so, can someone provide an example
You can do this by simply doing:
header('Location: palette.php?colID='.urlencode(str_replace(' ','-',$title)));
But in your palette.php, $_GET['colID'] will be receiving Funky-Colours instead of Funky Colours. So you need to use str_replace() again to convert the dashes to spaces.
So, another question would be, what do you intend to do with those column IDs with dashes? For instance, the $title submitted is Something-With-Dashes, your script would turn these dashes into spaces. But to answer your question, yes, it is possible to do this using str_replace().

Ampersand problem in XML when creating a URL String

I am working with an XML feed that has, as one of it's nodes, a URL string similar to the following:
http://aflite.co.uk/track/?aid=13414&mid=32532&dl=http://www.google.com/&aref=chris
I understand that ampersands cause a lot of problems in XML and should be escaped by using & instead of a naked &. I therefore changed the php to read as follows:
<node><?php echo ('http://aflite.co.uk/track/?aid=13414&mid=32532&dl=http://www.google.com/&aref=chris'); ?></node>
However when this generates the XML feed, the string appears with the full &
and so the actual URL does not work. Apologies if this is a very basic misunderstanding but some guidance would be great.
I've also tried using %26 instead of & but still getting the same problem.
If you are inserting something into XML/HTML you should always use the htmlspecialchars function. this will escape your strings into correct XML syntax.
but you are running into a second problem.
your have added a second url to the first one.
this need also escaped into url syntax.
for this you need to use urlencode.
<node><?php echo htmlspecialchars('http://aflite.co.uk/track/?aid=13414&mid=32532&aref=chris&dl='.urlencode('http://www.google.com/')); ?></node>
& is correct for escaping ampersands in an XML document. The example you've given should work.
You state that it doesn't work, but you haven't stated what application you're using, or in what way it doesn't work. What exactly happens when you click the link? Do the & strings end up in the browser's URL field? If that's the case, it sounds like a fault with the software you've viewing the XML with. Have you tried looking at the XML in another application to see if the problem is consistent?
To answer the final part of your question: %26 would definitely not work for you -- this would be what you'd use if your URL parameters needed to contain ampersands. Say for example in aref=chris, if the name chris were to an ampersand (lets say the username was chris&bob), then that ampersand would need to be escaped using %26 so that the URL parser didn't see it as starting a new URL parameter.
Hope that helps.

Automatic addition of trailing slash to urlencoded urls

I am very confused about the following:
echo("<a href='http://".urlencode("www.test.com/test.php?x=1&y=2")."'>test</a><br>");
echo("<a href='http://"."www.test.com/test.php?x=1&y=2"."'>test</a>");
The first link gets a trailing slash added (that's causing me problems)
The second link does not.
Can anyone help me to understand why.
Clearly it appears to be something to do with urlencode, but I can't find out what.
Thanks
c
You should not be using urlencode() to echo URLs, unless they contain some non standard characters.
The example provided doesn't contain anything unusual.
Example
$query = 'hello how are you?';
echo 'http://example.com/?q=' . urlencode($query);
// Ouputs http://example.com/?q=hello+how+are+you%3F
See I used it because the $query variable may contain spaces, question marks, etc. I can not use the question mark because it denotes the start of a query string, e.g. index.php?page=1.
In fact, that example would be better off just being output rather than echo'd.
Also, when I tried your example code, I did not get a traling slash, in fact I got
<a href='http://www.test.com%2Ftest.php%3Fx%3D1%26y%3D2'>test</a>
string urlencode ( string $str )
This function is convenient when
encoding a string to be used in a
query part of a URL, as a convenient
way to pass variables to the next
page.
Your urlencode is not used properly in your case.
Plus, echo don't usually come with () it should be echo "<a href='http [...]</a>";
You should use urlencode() for parameters only! Example:
echo 'http://example.com/index.php?some_link='.urlencode('some value containing special chars like whitespace');
You can use this to pass URLs, etc. to your URL.

Categories