Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:5059 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 17235 invoked by uid 1010); 29 Oct 2003 07:49:33 -0000 Delivered-To: ezmlm-scan-internals@lists.php.net Delivered-To: ezmlm-internals@lists.php.net Received: (qmail 17200 invoked from network); 29 Oct 2003 07:49:33 -0000 Received: from unknown (HELO milton.schell.de) (217.160.72.35) by pb1.pair.com with SMTP; 29 Oct 2003 07:49:33 -0000 Received: (qmail 13292 invoked by uid 501); 29 Oct 2003 07:49:33 -0000 Received: from unknown (HELO localhost) (217.160.91.103) by kdserv.de with SMTP; 29 Oct 2003 07:49:33 -0000 Date: Wed, 29 Oct 2003 08:49:34 +0100 (=?X-UNKNOWN?Q?Westeurop=E4ische_Normalzeit?=) To: internals@lists.php.net Message-ID: X-X-Sender: sas@tellyd2.de MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Subject: Re: [PHP-DEV] Re: header() behaviour (fwd) From: sascha@schumann.cx (Sascha Schumann) On Tue, 28 Oct 2003, Rasmus Lerdorf wrote: > On Wed, 29 Oct 2003, Christian Schneider wrote: > > > Gareth Ardron wrote: > > > $var = "foo=1&bar=2"; > > > > To clarify: > > You should use $var = "foo=1&bar=2"; and then $var for header() but > > htmlspecialchar($var) for your href: > > - HTTP-Headers must not be html-encoded. > > - HTML-Attributes on the other hand have to be html-encoded. > > > > Even though most browsers work with hrefs without html-encoding and some > > browsers might understand & in HTTP-Headers this is not conforming > > to the standards. > > Actually, & is the way you need to write it if you are going to be > perfectly standards-compliant. That is correct for URLs in HTML. It is incorrect for HTTP headers (there is no entity decoding involved). > It's just that nobody does this. Really? My applications supply their own php.ini and always contain arg_separator.output = "&" which is also listed in php.ini-dist. > You can > make PHP understand this by setting the separator in your php.ini file to > & Nope, input separators are always one character wide. - Sascha