$ GET replaces + with space, urlencode breaks (encodes) slashes

[JAB Creations]

My CMS allows creating and editing pages stored in an SQL database however I encountered a problem with plus signs and PHP's $_GET variable. By default it replaces plus signs with spaces however to the best of my knowledge plus signs are not a separator, ampersands are. After some research I noticed people suggesting the use of urlencode however that encodes all characters including slashes.

So here is an example partial URL of what I might see in the input text element and it's absolute URL in comparison...

xhtml/application-xhtml+xml
http://www.example.com/web/xhtml/application-xhtml+xml

My CMS editor allows me to edit the section (e.g. web/) and the page URL separately. I'm thinking I'll have to create a custom function for this as I simply want to display the characters as they would appear in the browser's address bar.

Thoughts please?

- John

[astupidname]

urlencode breaks (encodes) slashes

As it should, as it is to be used on all GET variable value assignments. Guess I don't see the problem as you have not shown how you are implementing, but this works fine:

<?php
 
$s = 'http://www.example.com/web/xhtml/application-xhtml+xml';
echo '<a href="?url='.urlencode($s).'">this page with ?url='.$s.'</a>';
$url = $_GET['url'];
if (!empty($url)) {
    echo '<br><br>$_GET[\'url\'] was: '.$url;
    echo '<br><a href="'.htmlentities($url).'">Go There</a>';
}
 
?>

[rainborick]

Wouldn't it be better to just use POST and let your script receive the pure data? GET is fine when you have a small number of short parameters, but encoding an entire web page-sized block of data means continually fighting an uphill battle.

[penders]

By default it replaces plus signs with spaces however to the best of my knowledge plus signs are not a separator...

But the plus sign is a special character in a URL. It is shorthand for an encoded space (the same as

%20

). If you want to actually have a plus sign in your URL then it must be encoded.

urlencode('+') = '%2B'

You probably don't need to encode the entire URL, just the part that matters - this is usually just the querystring. Unless you are including an entire URL as part of the querysting, as in astupidname's example.