How do you pass a url properly?

Phrank

I have a screen that shows database records. If the customer clicks on a record I go to a screen that shows the record.

I need to pass the a url. Looks like:

http://www.mydomain.com/categories.php?Mode=Update&category=Children's Books.

I am trying to pass a category name to the second program. $category = "Children's Books".

It stops at the first ' . If I use addslashes(category) it gets to the first space in the category part of the line.

I have tried urlencode($category) but that didn't work.

What function do I use or how would I handle the problem?

The line I am using looks something like this.

echo '<td align="top">' . '<a href=categories.php?Mode=Update&category='. urlencode($row['category']) . ">" . stripslashes($row['category']) . "</a></td>\n";

It's the <a> part that I cannot get to work.

Any help would be greatly appreciated.

TIA

laserlight

Use [man]urlencode/man, not addslashes() or even htmlspecialchars().

EDIT:
Ah, so you are already using urlencode(). Now, you need to use htmlspecialchars() on the link text, and delimit your URL with quotes:

echo '<td align="top"><a href="categories.php?Mode=Update&amp;category='
    . urlencode($row['category']) . '">' . htmlspecialchars($row['category'])
    . "</a></td>\n";

stolzyboy

FWIW, it would make your life easier, with quotes especially, if you would use PHP for the PHP and let the HTML be HTML.

NogDog

You should not need to use stripslashes() at all. If you do, then there's something wrong with how you are inserting data into the DB, most likely that you have magic_quotes_gpc enabled and then are escaping those slashes with something like mysql_real_escape_string. If that is the case, then you should first use stripslashes() before escaping the data for use in your SQL (or, better yet, turn off magic_quotes_gpc).

Once you get that resolved, then urlencode()-ing should work fine, along with htmlentities() for the text and quoting your href attribute's value:

echo '<td align="top"><a href="categories.php?Mode=Update&amp;category='. urlencode($row['category']) . '">' . htmlentities($row['category']) . "</a></td>\n";