Unicode for escaped string PHP/JS

Blackwind

I need help. I've spent so many hours on this already....

Ok Javascript escapes a string with a "†" and replaces it with "% u2020" (I had to put a space in between the % and the u2020 in order for it to show up properly on this forum)
Now PHP urldecode / rawurldecode ...don't decode as they should.

This is true for other special characters. I need to save this to a mySQL database and display it later on. (so if there is a mySQL trick I'm all for it...) When the string is called it shows up as % u2020 rather than the proper symbol. I'm not sure what to do, please HELP!

Oh I need the string escaped in javascript in order to make an AJAX call....

Thanks in advance!

Jack_McSlay

where does %u2020 come from? from what I see, javascript's encodeURI encodes it into %E2%80%A0

Blackwind

Jack McSlay wrote:
where does † come from? from what I see, javascript's encodeURI encodes it into %E2%80%A0

the % u2020 comes from using escape() in javacript. If I use encodeURIcomponent I do get %E2%80%A0.

When PHP goes to urldecode() it then it gives me "‚Ä†"

Jack_McSlay

from what I see the %uXXXX notation is nowhere valid outside Javascript itself. And also, it's not normally necessary to escape strings with Javascript before sending.
If you need to include characters outside the latin alphabet, the best practice is to encode everything using UTF-8 on your page.

I see no way to unescape the %uXXXX form other than making up a function to convert it.

Blackwind

Well the reason I escape it is so character such as "&" and will turn to & but I guess htmlspecialchars will take care of that. I'll try that out right now, though my only concern is that a person enters a " or ' and basically stops the javascript call partways.

A person enters † in the textbox or any other special character. I use javascript to escape() the string to pass it to PHP. PHP stores it in the database. And when I recall the text † displays as †

Jack_McSlay

script injection can only occur when the input text is to be compiled, by either the browser, http server or database server.
so unless you're using the eval() function for whatever reason, the only time you'll need to escape the string is before putting it into an sql query.