如何避免“+”符号引起的错误GET请求？

Question

My URL path:

https://mypage/main.php?dir=farm/1234_animal_fred+sam_cats

I am requesting the data with the GET method:

$dir = $_GET['dir'];
echo $dir;

But my result is

farm/1234_animal_fred sam_cats

Answer 1

Even though Unex's answer is right in this particular case, I am unsure if he would be missing other characters that may be in your DB that could cause something to fail, or worse yet, open you up to an XSS vulnerability. So instead of making it work in this one single case by doing:

$url = str_replace('+', '%2B', $url);

You want to instead make it work for all cases. So assuming you have the following from your database:

$file_path = 'farm/1234_animal_fred+sam_cats';

To make this work correctly as part of a URL you need to do urlencode(), however from this answer you will notice that it's not enough to protect you from XSS attacks. You therefore also need to use htmlspecialchars() on the string:

$url = 'https://mypage/main.php?dir=';
$file_path = 'farm/1234_animal_fred+sam_cats';
$url .= htmlspecialchars(urlencode($file_path));

echo $url; // https://mypage/main.php?dir=farm%2F1234_animal_fred%2Bsam_cats

And when going to this URL you can see that PHP gets the correct value:

print_r($_GET) output:
Array
(
    [dir] => farm/1234_animal_fred+sam_cats
)