更改帖子内容

Question

I have a file called: index.php, in which I have a form and within that form i got ajax code in which I do a call to a PHP file. This external PHP file will generate hidden input fields which will later on be appended in to my form.

This is the ajax code:

$urlforXmltoHtml = "xmltohtml.php";
$.get($urlforXmltoHtml,
  { uniquekey: Reference },
  function (data) {
    $("#Data").append(data);
    $('#msform').submit();
});

This is the div in the index.php where the generated hidden fields will be appended to:

 <div id="Data">
 </div>

In the xmltohtml.php i got this:

<?php

session_start();
$xml="";
//gebruik uniquekey van cops.php
$uniquekey = $_GET['uniquekey'];
if (file_exists('downloads/'.$uniquekey.'.xml')) {
    $xml = simplexml_load_file('downloads/'.$uniquekey.'.xml');
    foreach( $xml as $headItems )
      {

        foreach($headItems as $item){
          $_SESSION['count'] = $_SESSION['count'] + 1;
          $count =   $_SESSION['count'];
          echo '<div style="display:none;">';
          //preg replaces successive space characters
          $description = preg_replace('/\s+/', ' ', $item->->Description);
          //encoding http://php.net/manual/en/function.htmlentities.php
                 echo '<input type="hidden" name="DESCRIPTION['.$count.']" value="'. htmlspecialchars($description, ENT_QUOTES) .'">';
      echo '<input type="hidden" name="-QUANTITY['.$count.']" value="'. htmlspecialchars($item->Quantity,ENT_QUOTES) .'">';
          echo '</div>';
        }
      }
} else {

  exit('Failed to open xml.' . $uniquekey);
}
?>

but now as input when I got a $description for example witth item& then if i copy paste the html code from out chrome's element inspector I see it will be changed to item$amp; and actually when I post, I just want to post item& and not item&.

any idea how I could change this so it will send & and not &, or does it just send &?

Answer 1

You shouldn't send URL parameters by concatenating them to the URL, but by sending them as the data parameter to jQuery's $.get:

$urlforXmltoHtml = "xmltohtml.php";
$.get($urlforXmltoHtml,
  { uniquekey: Reference },
  function (data) {
    $("#Data").append(data);
    $('#msform').submit();
});

On a side note, what you're doing here is very dangerous:

$uniquekey = $_GET['uniquekey'];
if (file_exists('downloads/'.$uniquekey.'.xml')) {
    $xml = simplexml_load_file('downloads/'.$uniquekey.'.xml');

Never trust input from the client! In this case, you should whitelist a set of keys and only use those to retrieve/manipulate files on the server.