From:             john at pearcey dot net
Operating system: Windows XP 5.1.2600
PHP version:      4CVS-2004-06-14 (stable)
PHP Bug Type:     HTTP related
Bug description:  url decoding of POST varables

Description:
------------
I am using the Java class HttpURLConnection to post variables to a php
script and I'm encoding them using URLEncoder (UTF-8). The POST variables
do not seem to be decoded correctly when a double or single quote is in
the stream. A backslash character is prepended to it making it impossible
for me to send for example: 

select * from MyTable where MyColumn="brill"

I end up with 
select * from MyTable where MyColumn=\"brill\"

I have checked the string going to the server and it lookes like this for
the example above:

select+*+from+MyTable+where+MyColumn%3D%22brill%22

which of course is correct for UTF-8.

I have not tested this on Linux.

Reproduce code:
---------------
HttpURLConnection l_connection =
(HttpURLConnection)m_url.openConnection();
                l_connection.setDoOutput( true );

                String l_postVars = URLEncoder.encode("MySQL", "UTF-8") + "=" +
URLEncoder.encode("select * from MyTable where MyColumn=\"brill\"",
"UTF-8");

                OutputStreamWriter l_os = new OutputStreamWriter(
l_connection.getOutputStream() );
                l_os.write( l_postVars, 0, l_postVars.length() );
                l_os.flush();

PHP code:
echo $_POST['MySQL'];


Expected result:
----------------
select * from MyTable where MyColumn="brill"

Actual result:
--------------
select * from MyTable where MyColumn=\"brill\"

-- 
Edit bug report at http://bugs.php.net/?id=28779&edit=1
-- 
Try a CVS snapshot (php4):  http://bugs.php.net/fix.php?id=28779&r=trysnapshot4
Try a CVS snapshot (php5):  http://bugs.php.net/fix.php?id=28779&r=trysnapshot5
Fixed in CVS:               http://bugs.php.net/fix.php?id=28779&r=fixedcvs
Fixed in release:           http://bugs.php.net/fix.php?id=28779&r=alreadyfixed
Need backtrace:             http://bugs.php.net/fix.php?id=28779&r=needtrace
Need Reproduce Script:      http://bugs.php.net/fix.php?id=28779&r=needscript
Try newer version:          http://bugs.php.net/fix.php?id=28779&r=oldversion
Not developer issue:        http://bugs.php.net/fix.php?id=28779&r=support
Expected behavior:          http://bugs.php.net/fix.php?id=28779&r=notwrong
Not enough info:            http://bugs.php.net/fix.php?id=28779&r=notenoughinfo
Submitted twice:            http://bugs.php.net/fix.php?id=28779&r=submittedtwice
register_globals:           http://bugs.php.net/fix.php?id=28779&r=globals
PHP 3 support discontinued: http://bugs.php.net/fix.php?id=28779&r=php3
Daylight Savings:           http://bugs.php.net/fix.php?id=28779&r=dst
IIS Stability:              http://bugs.php.net/fix.php?id=28779&r=isapi
Install GNU Sed:            http://bugs.php.net/fix.php?id=28779&r=gnused
Floating point limitations: http://bugs.php.net/fix.php?id=28779&r=float

Reply via email to