PHP spaces in variable for hyperlink

Question

I'm quite new to php and I'm trying to add a series of variables into a html hyperlink. However any variables that return with spaces mess the hyperlink up.

    <html>
        <head>
            <title>Grants Test</title>
        </head>
        <body>
     <?php
     // Connect to Database 
     mysql_connect("XXXXXXXX", "XXXXXXX", "XXXXXXXXXX") or die(mysql_error()); 
     mysql_select_db("XXXXXXXXX") or die(mysql_error()); 

    $mode = $_GET['mode'];
    $Name = $_GET['Name'];
    $DOP = $_GET['DOP'];
    $SRN = $_GET['SRN'];
    $SUP = $_GET['SUP'];
    $COG = $_GET['COG'];
    $CUST = $_GET['CUST'];
    $Comments = $_GET['Comments'];
    $Upload_T = $_GET['Upload_T'];
    $Edit_T = $_GET['Edit_T'];
    $PONumber = $_GET['PONumber'];
    $self = $_SERVER['PHP_SELF'];


    //Edit Mode
     if ( $mode=="edit") 
     { 
     Print '<h2>Edit</h2> 
     <p> 
     <form action=';
     echo $self; 
     Print '
     method=GET> 
     <table> 

    <tr><td>PONumber:</td><td><input type="text" disabled="disabled" value="'; 
     Print $PONumber; 
     print '" name="PONumber" /></td></tr> 

     <tr><td>Name:</td><td><input type="text" value="'; 
     Print $Name; 
     print '" name="Name" /></td></tr> 

     <tr><td>Date of Purchase:</td><td><input type="text" value="'; 
     Print $DOP; 
     print '" name="DOP" /></td></tr> 

     <tr><td>Service Report:</td><td><input type="text" value="'; 
     Print $SRN; 
     print '" name="SRN" /></td></tr>

    <tr><td>Supplier:</td><td><input type="text" value="'; 
     Print $SUP; 
     print '" name="SUP" /></td></tr> 

    <tr><td>Cost ex.VAT:</td><td><input type="text" value="'; 
     Print $COG; 
     print '" name="COG" /></td></tr> 

    <tr><td>Customer:</td><td><input type="text" value="'; 
     Print $CUST; 
     print '" name="CUST" /></td></tr> 

    <tr><td>Comments:</td><td><input type="text" value="'; 
     Print $Comments; 
     print '" name="Comments" /></td></tr> 

     <tr><td colspan="2" align="center"><input type="submit" /></td></tr> 
     <input type=hidden name=mode value=edited> 
     <input type=hidden name=PONumber value='; 
     Print $PONumber; 
     print '> 
     </table> 
     </form> <p>'; 
     } 

     if ( $mode=="edited") 
     { 
     mysql_query ("UPDATE purchase SET Name = '$Name', DOP = '$DOP', SRN = '$SRN', SUP = '$SUP', COG = '$COG', CUST = '$CUST', Comments = '$Comments', Upload_T = '$Upload_T', Edit_T = NOW() WHERE PONumber = $PONumber"); 
     Print "Data Updated!<p>"; 
     } 

//Delete Mode
    if ( $mode=="remove") 
     {
     mysql_query ("DELETE FROM purchase where PONumber=$PONumber");
     Print "Entry has been removed <p>";
     }

//Show Table
     $data = mysql_query("SELECT * FROM purchase ORDER BY PONumber ASC") 
     or die(mysql_error()); 
     Print "<h2>Purchase Orders</h2><p>"; 
     Print "<table border cellpadding=3>"; 
     Print "<tr><th width=100>PONumber</th><th width=100>Name</th><th width=100>Date of Purchase</th><th width=100>Service Report</th><th width=100>Supplier</th><th width=100>Cost ex.VAT</th><th width=100>Customer</th><th width=100>Comments</th><th width=100>Time Requested</th><th width=100>Last Edited</th></tr>"; 
     while($info = mysql_fetch_array( $data )) 
     { 
     Print "<tr><td>".$info['PONumber'] . "</td> "; 
     Print "<td>".$info['Name'] . "</td> "; 
    Print "<td>".$info['DOP'] . "</td> "; 
    Print "<td>".$info['SRN'] . "</td> "; 
    Print "<td>".$info['SUP'] . "</td> "; 
    Print "<td>".$info['COG'] . "</td> "; 
    Print "<td>".$info['CUST'] . "</td> "; 
    Print "<td>".$info['Comments'] . "</td> "; 
    Print "<td>".$info['Upload_T'] . "</td> "; 
    Print "<td>".$info['Edit_T'] . "</td> "; 
    Print "<td><a href=" .$_SERVER['PHP_SELF']. "?PONumber=" . $info['PONumber'] ."&DOP=" . $info['DOP'] . "&Name=" . $info['Name'] . "&mode=edit>Edit</a></td>"; Print "<td><a href=" .$_SERVER['PHP_SELF']. "?PONumber=" . $info['PONumber'] ."&mode=remove>Remove</a></td></tr>"; 
    } 
     Print "</table>";

This is the line I'm having trouble with, data gets pulled from the database but any data with spaces get cuts short.

Print "<td><a href=" .$_SERVER['PHP_SELF']. "?PONumber=" . $info['PONumber'] ."&DOP=" . $info['DOP'] . "&Name=" . $info['Name'] . "&mode=edit>Edit</a></td>"; Print "<td><a href=" .$_SERVER['PHP_SELF']. "?PONumber=" . $info['PONumber'] ."&mode=remove>Remove</a></td></tr>";

See the output:

<a href="/beta/testscript.php?PONumber=3697&DOP=2014-11-23&Name=Joe" bloggs&mode="edit">Edit</a>

How can I stop this from happening?

Thanks, Grant

One way is to store the url in a variable and then encode your url (using urlencode) it which will convert the spaces to %20 — narendra
– narendra, Commented Dec 17, 2014 at 16:25

Tero Lahtinen · Accepted Answer · 2014-12-17 16:35:31Z

2

You need to encode the URL paramaters with urlencode.

Also, do not use mysql_ -functions, they are prone to errors leading to security vulnerabilities and will be removed from PHP later on. Learn PDO instead.

edited Dec 17, 2014 at 16:35

answered Dec 17, 2014 at 16:26

Tero Lahtinen

5246 silver badges16 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

slapyo Over a year ago

They need to urlencode the parameters, not the entire URL.

Tero Lahtinen Over a year ago

Correct, I changed my answer.

Álvaro González · Accepted Answer · 2014-12-22 16:10:19Z

0

This is the classical text-in-text problem. To do:

Escape special chars in URLs with rawurlencode()
Escape special chars in HTML with htmlspecialchars()

You are actually generating both so you need to do both escapings.

Don't forget to encode only the specific bits that are supposed to be free text.

To use the rawurlencode() function you just feed it with each input parameter and concatenate its outoup to the URL:

$url = $_SERVER['PHP_SELF']. "?PONumber=" . rawurlencode($info['PONumber']) ."&DOP=" . rawurlencode($info['DOP']) . "&Name=" . .....;

Once you have the URL, just inject it into HTML:

Print "<td><a href=" . htmlspecialchars($url) . ">Remove</a></td></tr>";

edited Dec 22, 2014 at 16:10

answered Dec 17, 2014 at 16:41

Álvaro González

147k45 gold badges282 silver badges378 bronze badges

1 Comment

Grant Over a year ago

Thanks Alvaro, I can't get my head around how to use the rawurlencode(), can you give me an example of how it should be used?

Collectives™ on Stack Overflow

PHP spaces in variable for hyperlink

2 Answers 2

2 Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related