QUICK RECAP – HTML FORM SUBMIT

For a start, let us have a quick recap for the beginners on HTML forms. But what does this have anything to do with URL encoding? We will get there, so bear with this for a minute.

  
    

      
        Name:
      
      
        Email:
      
      
  

When we submit the above form, it will redirect to the specified server script with a query string containing the form data. For example, http://localhost/1b-server.php?user-name=John+Doe&user-email=john%40doe.com.

WHAT IS URL ENCODING?

Notice that the empty space in John Doe is replaced with John+Doe? Also, the @ in the email is replaced with john%40doe.com? Yes, that is exactly what URL encoding is all about. There are certain rules to how the URL and query string can be formed, and in a nutshell:

• All non-alpha numeric characters will be replaced with a percent sign (%), followed by the corresponding hex code.
• White spaces will be replaced with the plus (+) sign.
• Dash, underscore, period (-_.) are the only exceptions and left as they are.

If you want to read more about query strings, I will leave a link to Wikipedia in the extras section below.

URL ENCODING IN PHP

In an HTML form, we simply have to set method="get" and it will automatically URL encode the form data into a query string on submit. In PHP, we can use the urlencode(STRING) function to do the same. 

 "John Doe",
  "email" => "[email protected]"
];

// We can create a query string with urlencode
$query = "?";
foreach ($data as $key=>$value) {
  $query .= urlencode($key) . "=" . urlencode($value) . "&";
}
$query = substr($query, 0,-1); // strip the last &
echo $query;
?>

This is very useful, for example, we may want to do server-to-server communication:

 "John Doe",
  "email" => "[email protected]"
];

// Build query string
$query = "?";
foreach ($data as $key=>$value) {
  $query .= urlencode($key) . "=" . urlencode($value) . "&";
}
$query = substr($query, 0,-1);

// Let's say that we have to send some data to this URL
// $targetURL = "http://another-site.com/form.php";
$targetURL = "http://localhost/1b-server.php";
$curl = curl_init();
curl_setopt_array($curl, [
  CURLOPT_URL => $targetURL . $query, // ! QUERY STRING APPENDED TO URL
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_HEADER => false
]);
$result = curl_exec($curl);
if ($result === false) {
  echo curl_error($curl);
  echo curl_errno($curl);
} else {
  print_r($result);
}
curl_close($curl);
?>

URL DECODE

Usually in a PHP script, the query string is parsed nicely into the $_GET global variable automatically. Following up with the above example after submitting the HTML form:

$value) {
  echo "KEY - $key | VALUE - $value" . PHP_EOL;
}
?>

But let’s say that we have a URL with a query string. In order to retrieve the data, we can either use the parse_url, or urldecode function.

";
  echo "VALUE - " . urldecode($chunkB[1]) . "
";
}
?>

WHY RAW? WHAT’S THE DIFFERENCE?

So why are there two? Long story short – Welcome to the confusing cyber world. There is some conflicting history, but here’s the difference in a nutshell:

• urldecode works the same way as how HTML form is encoded, the same as application/x-www-form-urlencoded media type.
• rawurldecode works the same way as according to RFC 3986.

They are somewhat similar, but with some differences in rawurldecode:

• Similarly, all non-alpha numeric characters will be replaced with a percent sign (%), followed by the corresponding hex code.
• White spaces will be replaced with %20 instead of the plus sign (+).
• Dash, underscore, period, and tilde (-_.~) are the exceptions (extra tilde).

A simple practice example will show you the differences:

";

// In raw encode
// dash-underscore_period.tilde~empty%20space
echo "Raw encode: " . rawurlencode($query) . "
";
?>

WHEN TO USE EACH ONE

Long story short again:

• Use rawurlencode on the path segment.
• But use urlencode on the query segment.

 "John Doe",
  "email" => "[email protected]"
];
$query = "?";
foreach ($data as $key=>$value) {
  $query .= urlencode($key) . "=" . urlencode($value) . "&";
}
$query = substr($query, 0, -1);

// The complete "safe" link ?>
">Click Here

Doh. It’s painful, but that’s how the Internet works…

REFERENCES

• PHP URL Encode
• PHP URL Decode
• Raw URL Encode
• Raw URL Decode
• Query Strings – Wikipedia

SOURCE CODE DOWNLOAD

Click here to download all the example source code, I have released it under the MIT license, so feel free to build on top of it or use it in your own project.
 

The post PHP URL Encode & Decode – Beginner’s Guide appeared first on Code Boxx.