From: john at pearcey dot net Operating system: Windows XP 5.1.2600 PHP version: 4CVS-2004-06-14 (stable) PHP Bug Type: HTTP related Bug description: url decoding of POST varables
Description: ------------ I am using the Java class HttpURLConnection to post variables to a php script and I'm encoding them using URLEncoder (UTF-8). The POST variables do not seem to be decoded correctly when a double or single quote is in the stream. A backslash character is prepended to it making it impossible for me to send for example: select * from MyTable where MyColumn="brill" I end up with select * from MyTable where MyColumn=\"brill\" I have checked the string going to the server and it lookes like this for the example above: select+*+from+MyTable+where+MyColumn%3D%22brill%22 which of course is correct for UTF-8. I have not tested this on Linux. Reproduce code: --------------- HttpURLConnection l_connection = (HttpURLConnection)m_url.openConnection(); l_connection.setDoOutput( true ); String l_postVars = URLEncoder.encode("MySQL", "UTF-8") + "=" + URLEncoder.encode("select * from MyTable where MyColumn=\"brill\"", "UTF-8"); OutputStreamWriter l_os = new OutputStreamWriter( l_connection.getOutputStream() ); l_os.write( l_postVars, 0, l_postVars.length() ); l_os.flush(); PHP code: echo $_POST['MySQL']; Expected result: ---------------- select * from MyTable where MyColumn="brill" Actual result: -------------- select * from MyTable where MyColumn=\"brill\" -- Edit bug report at http://bugs.php.net/?id=28779&edit=1 -- Try a CVS snapshot (php4): http://bugs.php.net/fix.php?id=28779&r=trysnapshot4 Try a CVS snapshot (php5): http://bugs.php.net/fix.php?id=28779&r=trysnapshot5 Fixed in CVS: http://bugs.php.net/fix.php?id=28779&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=28779&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=28779&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=28779&r=needscript Try newer version: http://bugs.php.net/fix.php?id=28779&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=28779&r=support Expected behavior: http://bugs.php.net/fix.php?id=28779&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=28779&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=28779&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=28779&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=28779&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=28779&r=dst IIS Stability: http://bugs.php.net/fix.php?id=28779&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=28779&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=28779&r=float