regex php url title escaping - php

Question

Hello I'm making a website and I have issues with htaccess clean url redirects when a user adds amps or slashes as a title for the article he is submiting.I decided thath I would like to allow only specific characters like alpanumeric, -, _, #,[,]. no quotes or double quotes etc etc...
I cant seem to make the regexp work I have not great esperience with regex and instead of using string replaces I thought I should ask.
Also any other proposals regarding this matter will be greatly appreciated
In my htaccess I have the following setup:
RewriteRule ^([^/]*)(.*)$ /index.php?page=$1&request=$2
and in my index I have:
include 'db.php';
include 'generic.php';
$pages = array('','main','events','news','rss','search','add-event');
if(isset($_GET['page']) && in_array($_GET['page'], $pages))
{
$event_category = null;
$event_title = null;
$search_string = null;
$rss_category = null;
$events_date = null;
$search_page = null;
validate_evented_page(trim(urldecode($_GET['page'])));
}
else
{
evented_error_page(404);
}
function evented_error_page($err)
{
include('errorpages/error.php');
}
function validate_evented_page($p)
{
$page = strtolower($p);
global $event_category;
global $event_title;
global $search_string;
global $rss_category;
global $events_date;
global $search_page;
if($page == 'main' || strlen($p) == 0)
{
include 'main.php';
}
else if($page == 'events')
{
$params = explode_url($_GET['request']);
if(count($params) == 0)
{
$events_date = "'';";
include 'allevents.php';
}
else if(count($params) == 1)
{
if(check_date($params[0]))
{
$date_split = explode('-',$params[0]);
$events_date = "'".date("m/d/Y" , mktime(0, 0, 0, date('m'), $date_split[1], date('Y')))."';";
}
else
{
$events_date = "'';";
}
include 'allevents.php';
}
else if(count($params) == 2)
{
$event_category = trim(urldecode($params[0]));
$event_title = trim(urldecode($params[1]));
include 'event.php';
}
else
{
evented_error_page(404);
}
}
}
the following url:
/events/Drum+%26+Bass/Innersense+presents+ETHOS_v04-0
gives $_GET['request'] = /Drum
when it should have been Drum & Bass (in the database I have stored this category as "Drum & Bass").

Answer 1

You need to tell mod_rewrite to encode the & that gets grouped in the backreferene using the B flag:
RewriteRule ^([^/]*)(.*)$ /index.php?page=$1&request=$2 [B,L]
The URI gets decoded when it gets sent through the rewrite engine. So the %26 gets decoded to &, the B flag ensures it gets re-encoded as the backreference.