I'm building a WordPress plugin in PHP to let customers send push notifications to mobile apps using OneSignal. I have a function that is both form and datahandler in that the action is recursive:
<form name='fcnaddpush' id='fcnaddpush' action="<?php echo $_SERVER['REQUEST_URI']; ?>" METHOD="POST" />
When the user clicks the submit button, the function calls itself and then parses out values entered in the form, creates an array, preps with json_encode(), then submits via cURL to OneSignal's REST API. It all works quite nicely, until.......
If the title or content contains an apostrophe it creates a problem. $_POST['title'] comes back with \' in the string, and json_encode double escapes it, so now it's has become it\'s. When the push notification arives with the double escaped apostrophe, the javascript function that displays the notification dies, and because the string has been written to a file on the mobile device, no notifications can be shown old or new without uninstalling and reinstalling the app.
SEEMINGLY I can solve this problem by using stripslashes($_POST['title']) before calling json_encode().
The question is, I suppose, are there going to be unintended consequences with other "special characters" when using stripslashes()? Is there a way to tell the POST method to use utf-8 instead of urlencode? Would that even work?
