# Consider the use of rawurldecode() on $_GET and $_REQUEST instead of urldecode()

- Thread: https://externals.io/message/54183
- Original archive: https://news-web.php.net/php.internals/54183
- Started by tigger.on@gmail.com on 2011-07-25T03:56:29+00:00
- Messages: 1
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #54183 — tigger.on@gmail.com — 2011-07-25T03:56:29+00:00

URL: https://externals.io/message/54183#54183

Current the following string (inside the quotes) "give me a + plz"
should be encoded correctly to "give%20me%20a%20+%20plz" when passed
as a query string.

Now when the query string is presented with $_GET['x'], the result is
"give me a   plz". Clearly wrong.

This leads to people (I'm sure I'm not the only one) using crazy hacks
to get something as simple as a query string var.

rawurlencode('give me a + plz') will produce "give%20me%20a%20%2B%20plz"
which is not "give%20me%20a%20+%20plz", but does not 'drop' the "+" when
someone types in the query string.

The following code can be used to show the error (lines may wrap):

<?php

    $str = 'give me a + plz';

    echo '
<a href="'.$_SERVER['SCRIPT_NAME'].'?qs='.$str.'">As typed by someone</a><br />
<a href="'.$_SERVER['SCRIPT_NAME'].'?qs='.urlencode($str).'">With
 `urlencode()`</a><br />
<a href="'.$_SERVER['SCRIPT_NAME'].'?qs='.rawurlencode($str).'">With
 `rawurlencode()`</a><br />
';

    if ($_GET['qs']) {
        echo '<p>Results:<br />
'.$_SERVER['QUERY_STRING'].' &#60; $_SERVER[QUERY_STRING]<br />
'.$_GET['qs'].' &#60; $_GET[qs]<br />
'.urldecode($_SERVER['QUERY_STRING']).' &#60;
urldecode($_SERVER[QUERY_STRING])<br />
'.rawurldecode($_SERVER['QUERY_STRING']).' &#60;
rawurldecode($_SERVER[QUERY_STRING])
</p>';
        // code to break up the query string because _GET[] is not
        // correct - NOT 100% reliable as well!!
        $tmp = explode('&',$_SERVER['QUERY_STRING']);
        foreach($tmp as $q) {
            $qs = explode('=',$q);
            for($i = 0; $i < count($qs) ; $i++) {
                $real_GET[$qs[$i]] = rawurldecode($qs[++$i]);
            }
        } // foreach

        echo '<p>
What was really passed?? Impossible to tell for sure but less likely to
be what _GET has:<br />'.$real_GET['qs'].'
</p>';

    } // _GET[qs]
?