PHP: $_GET['param'] insists on retaining quotes

bluegospel · 09-13-2011, 07:54 PM

I've got an XML File including this tag:

Code:

<url>innerpage.php?source='business.xml'</url>

I load that content via a client/server setup which defines:

Code:

$thissource=$_GET['source'];

When I echo $thissource in my php file I get:

Quote:

'business.xml'

when I want

Quote:

business.xml

I hope the problem is obvious to someone here, because I've seemingly tried everything. Thanks

frieza · 09-13-2011, 08:21 PM

assuming the file name will never have quotes in it you could always try changing

Code:

$thissource=$_GET['source'];

to

Code:

$thissource=ereg_replace("'","",$_GET['source']);

bluegospel · 09-13-2011, 08:37 PM

Quote:

Originally Posted by frieza

assuming the file name will never have quotes in it you could always try changing

Code:

$thissource=$_GET['source'];

to

Code:

$thissource=ereg_replace("'","",$_GET['source']);

Thanks frieza. I thought of something like that, but shouldn't the way I wrote my xml & script return the string without the quotes?

frieza · 09-13-2011, 10:15 PM

well the thing is, it looks as if the XML is pointing to a script on a web server if I'm not mistaken, which is passing value 'source' as $_GET source, but $_GET values are taken literally including white space and quotes, so you can either safely omit the quotes from the xml or filter them out.

Proud · 09-14-2011, 07:44 AM

HTML/GET values aren't quoted (see the URL of this page for e.g. "...showthread.php?p=4471019#post4471019"), expect them to be URLEncoded instead (think %20 = space, etc).
In PHP, $_REQUEST and $_GET values are automatically URL decoded (not $_POST), but again, this doesn't deal with quotes.
Whatever formed "innerpage.php?source='business.xml'" was either in error, or is implying the single quotes are parts of the string being passed.