HTML special characters

striker

I am having issues with the HTML Special Characters function in PHP. Here is my code:

$job_title = "inside sales";
$job_title = htmlspecialchars($job_title, ENT_QUOTES);
echo $job_title;

I get "inside sales" as my end result. It's my understanding that this function should add the html specifications for a space. Is this not correct? I've also tried it with something with a ' or " and that never gets translated to " which is what I am expecting. I am trying to pass this value through the link:

mypage.php?job_title=$job_title

...but I only get "inside" instead of "inside sales." Any ideas? Thanks!

DigitalExpl0it

<?
$job_title = "inside sales";
$job_title = htmlspecialchars($job_title, ENT_QUOTES);
echo "<a href='".$PHP_SELF."?job_title=".$job_title."'>Click here</a>";
?>

I have tested the code above and it works fine

striker

If you write the code as I had it, where you echo out $job_title, do you get "inside sales" or is there any character between the two words?

What happens if you set:

$job_title = "inside\"sales";

..and then run it through the function, do you still get inside"sales or does it add " or something between the two words?

website

Well, if you put a variable with spaces into the query_string (url) then in most cases it is translated by itself. Example:
$query_string = "some stuff";
$url = $SERVER['PHP_SELF'] . "?some=" . $query_string;
Then if you add the url to some link on the webpage and click on it you would go to the url
samesite.php?some=some%20stuff
Usually this comes like this. Then on that site if you do
$query_string = $GET['some'];
echo($query_string) //will echo some stuff.

However if you want to be abselutly secure you could translate all spaces to eg _ or - and then simply turn it back to spaces when you need to use it.

DigitalExpl0it

Originally posted by striker
If you write the code as I had it, where you echo out $job_title, do you get "inside sales" or is there any character between the two words?

What happens if you set:
$job_title = "inside\"sales";
..and then run it through the function, do you still get inside"sales or does it add " or something between the two words? [/B]

the other way worked fine also.. I just added the a href link tag in the example...

did mine work for you?

I did "inside/"sales" and I got inside"sales but if you click on the link mozilla and IE convert it to inside%22sales