htmlentites
This function is identical to htmlspecialchars() in all ways, except with htmlentites(), all characters which have HTML character entity equivalents are translated into these entities.
If you're wanting to decode instead (the reverse) you can use html_entity_decode().
Example:
echo htmlentities("&"); // &
if your directly doing this in the browser you should be able to use:
encodeURIComponent(string input);
Example:
encodeURIComponent($.trim($("input[name=t-tim_rendered-"+id+"]").val().toString()));
htmlentites
This function is identical to htmlspecialchars() in all ways, except with htmlentites(), all characters which have HTML character entity equivalents are translated into these entities.
If you're wanting to decode instead (the reverse) you can use html_entity_decode().
Example:
echo htmlentities("&"); // &
if your directly doing this in the browser you should be able to use:
encodeURIComponent(string input);
Example:
encodeURIComponent($.trim($("input[name=t-tim_rendered-"+id+"]").val().toString()));
I've been having a huge problem exactly with this situation.
This is just to say that the last answer from Andrew Koester is the perfect answer I was looking for.
In case you are passing multiple form entries from a jQuery form to PHP through the .ajax() call like this:
data: "name=" + name + "&message=" + message + ...
DON'T USE THIS METHOD, it will block the ampersand(&) character from being written by the user on any of the input fields of your form.
Use this one instead as suggested by Andrew:
data: {"name": name, "email": email, "subject": subject, "comments": comments},
This way the user can write any kind of special character whithout worrying a about conflicting with the ajax declaration.
How do I escape an ampersand in a url? - PHP Coding Help - PHP Freaks
php - Escape ampersand character - Stack Overflow
string - PHP Escape ampersand when printing - Stack Overflow
php - How to escape ampersand symbol - Stack Overflow
I want to allow users to include ampersands in their posts but that could leave the site open to XSS attacks. I'm escaping the posts just before they're printed using htmlspecialchars() but this, of course, escapes the ampersands, causing them to show up as "& amp;".
Is there a safe way to allow the ampersand character as user input?
EDIT: further clarification
You need to send your URL using the % to escape the ampersand.
Try it like this 'One %26 Two'
<?PHP
echo ((isset($_GET['P'])) ? print_r($_GET) : "<a href='http://example.com/a.php?P=One %26 Two'>One & Two</a>");
?>
you can follow this.if your array is like that
$data = array('p'=>'one',
'q'=>'two');
you can build url like this
echo http_build_query($data)
it will give output like this
p=one&q=two
It sounds like it's not being urlencoded properly. Are you building the request yourself (using AJAX for example)?
Depending on the AJAX library you're using (if any) you may need to manually escape your data:
Imagine your editor contains "Beans&sausages". You post this in the variable "text":
text=Beans&sausages
This looks to PHP like
text = Beans
sausages = null
In Javascript use encodeURIComponent() to fix this.
are you able to print_r() the raw contents as they are submitted to verify that PHP is getting the whole string?
If your editor is chopping it off at the ampersand then it's a problem before PHP is involved.
Looks like the bug is with your WYSIWYG editor, not with the insertion of data into the database then. Try capturing the output with JavaScript before the form is posted to be sure.
My guess is somehow the '&' is making it, unencoded, into your query string like:
http://yoursite/?message=hello&whatsup
This will resulting in the GET variable "message" Having the value of "hello" and the GET variable "whatsup" having an empty value.
If this is happening, you just need to stop it.
You can encode it as '%26' in the querystring.
I don't have that issue in a console:
php > $d="g&abc123";
php > echo $d;
g&abc123
What environment are you printing the output to? It sounds like you are viewing it in a web browser, and the & is being interpreted as a malformed HTML entity. Try replacing the & symbol with the entity encoded version &.
Look at the source code, it will be printing the correct code.
If you want it to print out correctly in HTML, then run htmlentities on it or make the & &