为什么PHP URL编码让我拒绝403访问

Question

I'm trying to pass some $_GET information from one web page to another via an a href in a php (5.6.25) file. When I omit URLencoding, Apache/2.4.23 finds the URL just fine. With URLencoding, I'm denied access. The both versions of the href sit in the same file using the same server.

Without URLencoding but working:

<?php
    $url = "Manage_Cumulative_DEV.php";
    $url .= /*URLencode*/ ('?thread_ID='.$row['thread_ID']);
?>
<a href="<?php echo htmlspecialchars($url); 
?>">
<?php echo htmlspecialchars($display_text);
echo '<br>';
?>
</a>
<?php 

The successful link looks like this:

http://localhost/WS_map_code/Manage_Cumulative_DEV.php?thread_ID=437769

With URLencoding - and broken:

<?php
    $url = "Manage_Cumulative_DEV.php";
    $url .= URLencode('?thread_ID='.$row['thread_ID']);
?>
<a href="<?php echo htmlspecialchars($url); 
?>">
<?php echo htmlspecialchars($display_text);
echo '<br>';
?>
</a>
<?php 

When I run the URLencoded version, I get a 403 error code and this message: Forbidden You don't have permission to access /WS_map_code/Manage_Cumulative_DEV.php?thread_ID=437769 on this server. Apache/2.4.23 (Win64) PHP/5.6.25 Server at localhost Port 80 (Note how the error message quotes the same href that had worked successfully for me without URL encoding. It seems to know what I'm trying to say.)

The failed, URLencoded href (as copied from the address bar) looks like this and seems right: http://localhost/WS_map_code/Manage_Cumulative_DEV.php%3Fthread_ID%3D437769

I know I'm being thick, because I've poked, prodded and researched it for hours. I ask mercy of the thinner.

Answer 1

$url = "Manage_Cumulative_DEV.php?thread_ID=";
$url .= URLencode($row['thread_ID']);

should do the trick. In your code you're URLencoding the ? which leads to an invalid request url