不要在表单提交时转义特殊字符

Question

I have a form that submits via GET, and one of the hidden fields submits a list of category IDs, separated by comma (1,2,3).

When the get query gets to the page it is going, commas become escaped with %2C.

I cannot make changes to PHP that parses these values, and they must remain commas.

In summary: ?category=1,2,3 works, and ?category=1%2C2%2C3 doesn't.

How do I prevent the comma from being encoded?

Edit to address the comment, simplified, but gives you the gist:

<form method="get" action="something.php">
<input type="hidden" name="category" value="1,2,3">
<input type="submit">
</form>

Answer 1

The problem with "making it stop" is that the encoding is a part of HTTP standards - you "shouldn't want" to make it stop since it is a part of the very basis upon which HTTP is built. RFC2396 describes which characters are allowed and not allowed in a URI:

2.2. Reserved Characters

Many URI include components consisting of or delimited by, certain special characters. These characters are called "reserved", since
their usage within the URI component is limited to their reserved
purpose. If the data for a URI component would conflict with the
reserved purpose, then the conflicting data must be escaped before
forming the URI.

  reserved    = ";" | "/" | "?" | ":" | "@" | "&" | "=" | "+" |
                "$" | ","

Because of this fact, when using GET to submit a form, the user agent will encode the values according to this specification.

Your solution lies in either

1) Change the form to use the POST method, change references to $_GET into $_POST in php

2) Call urldecode (docs) on the data before using it ($_GET['my_value'] = urldecode($_GET['my_value']);)

3) Use element arrays to submit this as an array to the server

<input name="myElement[]" value="1" />
<input name="myElement[]" value="2" />
<input name="myElement[]" value="3" />

On PHP side, $_GET['myElement'] will be equal to array(1,2,3)