Escaping CURL # symbol with PHP - php

Question

I'm writing a php application that submits via curl data to sign up for an iContact email list. However I keep getting an invalid email address error. I think this may be due to the fact that I'm escaping the # symbol so it looks like %40 instead of #. Also, according to the php documentation for curl_setopt with CURLOPT_POSTFIELDS:
The full data to post in a HTTP
"POST" operation. To post a file,
prepend a filename with # and use the
full path.
So, is there anyway to pass the # symbol as post data through curl in php without running it through urlencode first?

Answer 1

Use http_build_query() on your data-array first before passing it to curl_setopt(), that will lead to it sending the form as application/x-www-form-encoded instead of multipart/form-data (and thus the # is not interpreted).
Also why do you really care about the # in an email-address? It only matters if the # is the first character, not somewhere in the middle.

Answer 2

After search PHP curl manual, I found there is no information to escape the first ‘#’ if the post field is a string instead of a file if post with multipart/form-data encoding.
The way I worked around this problem is prefixing a blank at the beginning of the text. While our backend API will strip blanks so it could remove the blank and restore the original text. I don't know weather Twitter API will trim blanks on user input.
If so, this workaround also works for you.
If any one found the way to escaping the first '#' when using PHP curl with multipart/form-data encoding, please let us know.

Answer 3

I ran into the same issue, though with curl itself and not PHP curl.
When using curl's field option '-F' a leading # symbol will not be sent in the POST but instead will instruct curl to send the file name that immediately succeeds the symbol as part of the POST.
Fortunately, curl offers another option '--form-string', which behaves the same way as '-F', except that the 'form-string' option is not parsed.
As an example, if you want to use curl to POST field1 with value "#value" and file1 with the file "testfile.txt" you can do so as follows:
curl "http://www.url.com" --form-string "field1=#value" -F "file1=#testfile.txt"

Answer 4

This is the true solution that can support both string containing # and files.
Solution for PHP 5.6 or later:
Use CURLFile instead of #.
Solution for PHP 5.5 or later:
Enable CURLOPT_SAFE_UPLOAD.
Use CURLFile instead of #.
Solution for PHP 5.3 or later:
Build up multipart content body by youself.
Change Content-Type header by yourself.
The following snippet will help you :D
<?php
/**
* For safe multipart POST request for PHP5.3 ~ PHP 5.4.
*
* #param resource $ch cURL resource
* #param array $assoc "name => value"
* #param array $files "name => path"
* #return bool
*/
function curl_custom_postfields($ch, array $assoc = array(), array $files = array()) {
// invalid characters for "name" and "filename"
static $disallow = array("\0", "\"", "\r", "\n");
// initialize body
$body = array();
// build normal parameters
foreach ($assoc as $k => $v) {
$k = str_replace($disallow, "_", $k);
$body[] = implode("\r\n", array(
"Content-Disposition: form-data; name=\"{$k}\"",
"",
filter_var($v),
));
}
// build file parameters
foreach ($files as $k => $v) {
switch (true) {
case false === $v = realpath(filter_var($v)):
case !is_file($v):
case !is_readable($v):
continue; // or return false, throw new InvalidArgumentException
}
$data = file_get_contents($v);
$v = call_user_func("end", explode(DIRECTORY_SEPARATOR, $v));
list($k, $v) = str_replace($disallow, "_", array($k, $v));
$body[] = implode("\r\n", array(
"Content-Disposition: form-data; name=\"{$k}\"; filename=\"{$v}\"",
"Content-Type: application/octet-stream",
"",
$data,
));
}
// generate safe boundary
do {
$boundary = "---------------------" . md5(mt_rand() . microtime());
} while (preg_grep("/{$boundary}/", $body));
// add boundary for each parameters
array_walk($body, function (&$part) use ($boundary) {
$part = "--{$boundary}\r\n{$part}";
});
// add final boundary
$body[] = "--{$boundary}--";
$body[] = "";
// set options
return curl_setopt_array($ch, array(
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => implode("\r\n", $body),
CURLOPT_HTTPHEADER => array(
"Expect: 100-continue",
"Content-Type: multipart/form-data; boundary={$boundary}", // change Content-Type
),
));
}
?>

Answer 5

#PatricDaryll's answer is correct, but I needed to make a bit of researches to understand where to use this http_build_query function.
To clarify and summarise, instead of doing:
curl_setopt($ch, CURLOPT_POSTFIELDS, $array);
You will use:
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($array));
Simple but confusing... curl is smart enough to understand if you gave him a string or an array.

Answer 6

In order to escape the # sign in the non-file data, you need to do the following.
Prepend the text string with the NULL character
$postfields = array(
'upload_file' => '#file_to_upload.png',
'upload_text' => sprintf("\0%s", '#text_to_upload')
);
$curl = curl_init();
curl_setopt($curl, CURLOPT_URL, 'http://example.com/upload-test');
curl_setopt($curl, CURLOPT_POSTFIELDS, $postfields);
curl_exec($curl);
curl_close($curl);