PHP problem handling urlencoded '&' (%26) char

[FShoppe]

Hello all,

A script we are working on deals with passing file names in the URL (via $_GET). Some files contain the '&' symbol in the name.

& is the separator in PHP to identify the new $_GET variable.

We typically use urlencode($theString) to encode 'funny' characters to be URL safe. However, PHP seems to treat the encoded '&' value in exactly the same way as if it were not encoded.

Here is an example of the problem.

File name is Q&A.jpg

The script may be like this

<?php
$fileName = $_GET[fileName];
echo $fileName;
?>

If the url in the browser was script.php?fileName=Q&A.jpg, the output would be Q.

If you url encode the file name, the url would appear as script.php?fileName=Q%26A.jpg

However the output is still just Q without the '&A.jpg'.

Similarly, we have tried using rawurlencode, but this does not fix the problem either.

Anyone familiar with this problem and know a fix?

FShoppe Reviewed by FShoppe on 26th Aug 2012. PHP problem handling urlencoded '&' (%26) char Hello all, A script we are working on deals with passing file names in the URL (via $_GET). Some files contain the '&' symbol in the name. & is the separator in PHP to identify the new $_GET variable. We typically use urlencode($theString) to encode 'funny' characters to be URL safe. However, PHP seems to treat the encoded '&' value in exactly the same way as if it were not encoded. Here is an example of the problem. Rating: 5

[Lifetalk]

Not too sure, but I remember a bit vaguely that this used to happen because the browser is itself decoding the urlencoded char before it sends the actual GET request. This obviously has a 'fix', if you will. I just can't seem to remember it at the moment. I'll dig into my archives, see if I have a similar issue I encountered and fixed in the past.

[Gaurav]

urlencoded string fetches '&' character without issues here..

Tested this code snippet:

<?php

if(isset($_GET['var'])) {
    echo $_GET['var'];
}

?>

Forks fine on Chrome 21.0.1180.57 and FF 14.0.1

Regards,
Gaurav

[mRAza]

after encoding URL with urlencode() , did u decode it by urldecode on output?

<?php
//$_GET[fileName]  == Q%26A.jpg
$fileName = $_GET[fileName];
echo urldecode($fileName);
?>

Edit : My bad urdecode is bad thing :/ thanks for reminding me out

[FShoppe]

Hi mRAza,

No I did not. This is not required as the superglobal $_GET is already url decoded. Decoding a second time may result in unexpected and unwanted problems.

Guarav, it doesnt work for me

---------- Post added at 06:03 PM ---------- Previous post was at 05:57 PM ----------

Okay, the code I wrote above actually DOES work. Something is wrong somewhere else, but I'm not sure where or why.

---------- Post added at 06:12 PM ---------- Previous post was at 06:03 PM ----------

Okay found the problem! But not the solution.

In fact the urlencoding DOES work, however, aparantly not in conjunction with apache's mod_rewrite.

Instead of somedomain.com/script.php?fileName=Q%26A.jpg (which works), I have been using somedomain.com/file/Q%26A.jpg (which doesnt work). Evidently, the mod_rewrite is breaking it.

Any ideas?

[Gaurav]

Post the Rewrite you've defined. That might help sorting out the problem

[FShoppe]

Essentially, the rule is:

RewriteRule ^file/([^/]+)/?$ script.php?fileName=$1 [NC]

[Gaurav]

http://blog.perplexedlabs.com/2008/0...al-characters/

URL Encode twice

[FShoppe]

encoding twice is not really an option as it will break other things.

[mRAza]

Edit: try this

RewriteRule ^file/([^/]+)/?$ script.php?fileName=$1 [NC,B] 

I have just tested above, worked...

Reference: [B] Flag , you might also need [QSA] Flag