According to http://php.net/manual/en/function.urldecode.php, PHP does urldecode() on $_GET and on $_REQUEST (which contains $_POST).
But is directly calling $_POST already decoded?
Asked
Active
Viewed 8,482 times
12
Ethan Allen
- 14,425
- 24
- 101
- 194
-
Yes it is already urldecoded. – Michael Berkowski Feb 19 '16 at 23:17
-
The docs explicitly say so for `$_GET`, though only in user-contrib comments for `$_POST`. http://php.net/manual/en/reserved.variables.get.php – Michael Berkowski Feb 19 '16 at 23:18
-
Which comment Michael? – Ethan Allen Feb 19 '16 at 23:22
-
1[First one on the $_POST docs](http://php.net/manual/en/reserved.variables.post.php#87650) – Michael Berkowski Feb 19 '16 at 23:23
-
@MichaelBerkowski That actually seems to be talking about the way it converts `[]` names into an array, not URL-decoding. – Barmar Apr 27 '16 at 18:05
1 Answers
21
Yes, all the parameters you access via $_GET and $_POST are decoded.
The reason the urldecode() documentation doesn't mention $_POST is because the POST data might not be URL-encoded in the first place. It depends on whether the POST data is submitted in application/x-www-form-urlencoded format or multipart/form-data format.
But all this is transparent to the application.
The documentation of $_GET does mention this explicitly, though.
Note:
The GET variables are passed throughurldecode().
Barmar
- 741,623
- 53
- 500
- 612
-
From [the $_GET docs](http://php.net/manual/en/reserved.variables.get.php): "Note: The GET variables are passed through urldecode()." – doub1ejack Apr 27 '16 at 17:22
-
It's application/x-www-form-urlencoded -- you missed the last d. That's 20 minutes of my life I won't get back :) – Roger Kaplan May 22 '19 at 13:53
-
@RogerKaplan Thanks, I fixed the typo. You rarely need to write this by hand, it's usually handled automatically by APIs. – Barmar May 22 '19 at 14:06
-
@Barmar I'd agree with you but if you're at a question about the lower level of PHP form handling, you've probably gone off-piste. I was trying to adapt an AJAX call to a PHP framework expecting a regular form... – Roger Kaplan May 22 '19 at 21:14