How do I prevent '%20' in encoded text from being converted to a space?

Asked May 12 '21 at 17:28

Active May 12 '21 at 17:49

Viewed 49 times

I have a web app that accepts and saves plain text input. The relevant JS looks like

var newText = document.getElementById("textarea").value;
newText = encodeURIComponent(newText);
var save = new XMLHttpRequest();
save.open('POST', 'write.php', true);
save.setRequestHeader('Content-type', 'application/x-www-form-urlencoded');
save.send('u=' + user + '&text=' + newText);

and the relevant PHP looks like

$savetext = $_POST['text'];
$savetext = rawurldecode($savetext);

At this point, if a user originally typed %20 it is saved as a space.

I also tried replacing %20 with + in the JS after encodeURIComponent and before sending it, but it didn't seem to help. I still want to preserve actual spaces of course, but in case someone needs to write the actual three character string %20, I don't want it to disappear.

edited May 12 '21 at 17:49

asked May 12 '21 at 17:28

Brian Sutorius

1

`encodeURIComponent("%20")` will encode it for you – Wazeed May 12 '21 at 17:35
1

"if a user originally typed %20 it is saved as a space" — That shouldn't happen. Can you share some code? – Álvaro González May 12 '21 at 17:36
Álvaro I updated the post, sorry – Brian Sutorius May 12 '21 at 17:42
1

You don't use `rawurldecode` on the server side. Apache/Nginx does that for you automatically. – miken32 May 12 '21 at 18:01
[cannot reproduce](https://jsfiddle.net/05vrLqx3/). If user inputs "%20", then it is encoded as "%2520". – trincot May 12 '21 at 18:03
@trincot it's because they're getting "%20" in PHP as the result of automatic decoding, and then manually decoding again on the server side. – miken32 May 12 '21 at 18:05
Aha! Thank you miken32! – Brian Sutorius May 12 '21 at 18:08
Escaping is not the same as encoding. If you encode in e.g. Base64 you need to decode afterwards. Escaping is just a syntax trick. – Álvaro González May 13 '21 at 08:05

How do I prevent '%20' in encoded text from being converted to a space?

0 Answers0