[RESOLVED] urldecode() function not decoding whitespace +

20pictures

I am working on a form to submit a file for deletion. As many of these filenames have whitespace elements I have used the urlencode() function. However, when I urldecode() the + symbol is not decoded to whitespace & an error occurs. What am I doing wrong?

Here is the code from delete.php with some variations on decoding:

$file= 'test image.jpg'; 

echo "<form method=\"post\" name=\"deleteFile\" action=\"delete.php?delete=true\">           

<input type=\"hidden\" name=\"FileToDelete\" value=".urlencode($file)." > 
<input class=\"delete_button\" type=\"submit\" value=\"X\"></div></form>"; 

if(isset($_GET['delete']) && $_GET['delete']=='true') {    

echo $_POST[urldecode("FileToDelete")].' #1'.'<br>'; 
echo $_POST[urldecode('FileToDelete')].' #2'.'<br>'; 
echo $_POST[htmlspecialchars(urldecode('FileToDelete'))].' #3'.'<br>'; 
}

sneakyimp

Firstly, you need to put double quotes around urlencode($file):

echo "<form method=\"post\" name=\"deleteFile\" action=\"delete.php?delete=true\">           

<input type=\"hidden\" name=\"FileToDelete\" value=\"".urlencode($file)."\" >
<input class=\"delete_button\" type=\"submit\" value=\"X\"></div></form>";

Secondly, you want urldecode($POST["FileToDelete"]) and not $POST[urldecode("FileToDelete")]:

echo urldecode($_POST["FileToDelete"]) . ' #1' . '<br>';

As it's written, your code is urldecoding the string "FileToDelete" which is just an array key and not the value submitted in your form. As this array key has only letters in it, it doesn't change anything.

Also, urlencode will probably work to keep a string from breaking your html, but you probably want to use [man]htmlspecialchars[/man] instead. This turns angle brackets (< and >) and quotes (' and ") into their html-encoded equivalents.

20pictures

Thanks. That works.

I assume you meant:

echo htmlspecialchars(urldecode($_POST['FileToDelete'])) ;

sneakyimp

Nope. I'm saying that urlencode/urldecode should be used in the context of urls, not in the context of form inputs.
Read the Friendly Manual on [man]htmlspecialchars[/man].

echo "<form method=\"post\" name=\"deleteFile\" action=\"delete.php?delete=true\">           

<input type=\"hidden\" name=\"FileToDelete\" value=\"" . htmlspecialchars($file) . "\" >
<input class=\"delete_button\" type=\"submit\" value=\"X\"></div></form>";

The other advantage is that you won't have to decode it in your form submission handling code.

20pictures

I had originally passed over htmlspecialchars() as I did not think it included whitespace (which is the main problem I am having). Is this not the case & it will resolve whitespace?

sneakyimp

I'm not sure I understand why you are worried about whitespace? htmlspecialchars does not change whitespace and I don't think you need to. For example this form input:

<input type="hidden" name="file_to_delete" value="some really long file name with space in it.txt">

If you POST that form to your script, you'll get the exact filename spaces and all.

Derokorian

unless of course you don't have the quotes in the html, as sneaky pointed out on his first post. In which case only the first word would be sent! Valid HTML is just as important as valid PHP

20pictures

Thank you both, that has clarified the issue. I had originally thought I had a whitespace problem as I was getting truncated filenames. That is why I thought encoding was the answer.

Now I see it was an issue with the number of HTML double-quotes. The confusion was enhanced as I know ' as a single-quote & " as a double-quote ...so I required double double-quotes.

bradgrafelman

20pictures;10994128 wrote:
so I required double double-quotes.

Not really, there's still just a single double quote on either side of the attribute value in the HTML. The only difference is the string itself was delimited using double quotes, so any literal double quotes appearing in the string must be escaped with a backslash. It just so happened that immediately after the literal double quote, you also needed to end the string (by placing an ending delimiter - a double quote). The two are quite separate, and the need to escape the former could be avoided simply by using a single quote to delimit the string, using the heredoc syntax, escaping in and out of PHP mode as needed, etc.