0

I have a search form. I use the following line to get the value. When it returns, it replaces plus sign to space, letters after single/double quotes are deleted. I want to enable users to search for the keywords they want. How can I allow these letters to display?

$title = trim(filter_input(INPUT_GET, 'title', FILTER_SANITIZE_SPECIAL_CHARS));

When I send with GET.

header("Location:http://site.org/search/?title=$title");

I tried using urlencode() and works for plus signs, but it didn't work for quotes. For example c"s would return c"s.

Thanks.

2
  • Why do you need to change the quotes? If you send it in a url, urlencode will encode only the characters that need to be encoded.
    – jeroen
    Dec 7, 2012 at 17:04
  • I want to make it search for books title records which may contain a single quote or apostrophe.
    – awonderer
    Dec 7, 2012 at 18:04

3 Answers 3

1

Those are special characters that correspond to what they are appearing to be, for instance a plus in a GET request corresponds to a space.

Please see this link.

You will have to replace these characters before you redirect. You can do this with urlencode.

4
  • I see. I tried header("Location:http://site.org/search/?title=".urlencode($title)."); It works for plus signs. Single quote displays in the <input>. Double quote strips the rest of letters and I can't get single quote to match with the search result. The url gets encoded for + to %2B, but single quotes stays as '.
    – awonderer
    Dec 7, 2012 at 17:59
  • When I run urlencode('"'), I get %22 as output, and urlencode("'") outputs %27
    – Liftoff
    Dec 7, 2012 at 18:02
  • I get that output, too, when I echo it, but it doesn't show up on the url above. Single quote displays ...org/?title=' For plus sign, it shows %2B.
    – awonderer
    Dec 7, 2012 at 18:08
  • If I run this: header("Location:index.php?a=".urlencode("'"));, it takes me to my index page with the proper variable: index.php?a=%27.
    – Liftoff
    Dec 7, 2012 at 18:49
0

From the manual for FILTER_SANITIZE_SPECIAL_CHARS

HTML-escape '"<>& and characters with ASCII value less than 32, optionally strip or encode other special characters.

If the ascii value of the characters you are trying to are below 32, you will probably need to go a different route.

1
  • Right, it makes sense. Quotes are being stripped.
    – awonderer
    Dec 7, 2012 at 18:01
0

You need to encode / escape your data for the medium you are outputting to:

  • use url_encode to send the variables via a url;
  • use prepared statements with bound variables to query the database, that way you are safe from sql injection and you can search for texts with quotes in the database;
  • use htmlspecialchars to output your results to html or something like json_encode to send it to javascript.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.