PHP GET method space error - php

Question

<?php
$current_subject = $_GET['subject_id'];
$current_content = $_GET['note_id'];
echo "<form method=\"post\" action=mainpage.php?subject_id=".$current_subject."&note_id=".$current_content.">";
?>
<input type='text' name='list_item' value=''>
<input type='submit' name="new_item" value="New Item">
</form>
The problem is that when one of the GET variables is two words the link doesn't write it that way. So for example if $current_subject="Advanced Chemistry" and $current_content="Valence Electrons" the link will come out as:
<form method=​"post" action=​"mainpage.php?subject_id=Advanced" chemistry&note_id=​"Valence" electrons>​

Answer 1

You need to urlencode() the variables like so:
<?php
$current_subject = $_GET['subject_id'];
$current_content = $_GET['note_id'];
$subject = urlencode($current_subject);
$content = urlencode($current_content);
$action = "mainpage.php?subject_id=" . $subject . "&note_id=" . $content;
?>
<form method="post" action="<?php echo $action; ?>">
<input type="text" name="list_item" value="">
<input type="submit" name="new_item" value="New Item">
</form>
Also, you should get in the habit of validating that data. You probably want to check that they are integers.

Answer 2

Use urlencode() or rawurlencode()

Answer 3

Always quote your attributes and escape your data. Quoted, it would work:
<?php
$current_subject = $_GET['subject_id'];
$current_content = $_GET['note_id'];
echo "<form method=\"post\" action=\"mainpage.php?subject_id=" . $current_subject . "&note_id=" . $current_content . "\">";
?>
<input type="text" name="list_item" value="" />
<input type="submit" name="new_item" value="New Item" />
</form>
But, of course, you should urlencode it first:
<?php
$current_subject = $_GET['subject_id'];
$current_content = $_GET['note_id'];
$url = 'mainpage.php?subject_id=' . urlencode($current_subject) . '&note_id=' . urlencode($current_content);
?>
<form method="POST" action="<?php echo $url; ?>">
<input type="text" name="list_item" value="" />
<input type="submit" name="new_item" value="New Item" />
</form>

Answer 4

I would probably use http_build_query:
$query = http_build_query(array('subject_id' => $_GET['subject_id'], 'foo' => 'bar'));
<form action="mainpage.php?<?php echo $query; ?>">
I have a suspicion that $query should also be htmlentities'd.
The http_build_query handles the URI encoding, but I'm not sure if it should also be HTML-encoded on top of that (it is an HTML attribute after all).

Answer 5

You should have a look at PHPs urlencode()
$current_subject = urlencode($_GET['subject_id']);
$current_content = urlencode($_GET['note_id']);