|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2006-01-28 00:16 UTC] karel at linux dot be
Description:
------------
PHP-version: 4.3.11 (linux), and 4.4.0 (windows)
I don't know if this bug is reproducible on any higher version of PHP as I don't have them to work on.
If you submit a POST/GET/parse_str() to a webpage, where a variable has an URLencoded string in it, which contains %00. It will end up being mangled totally.
Just check the reproduce-code, it'll be more clear then my explanation here.
Reproduce code:
---------------
$comp_me = gzcompress('Compress me', 9);
parse_str( 'var='. urlencode( $comp_me ) );
var_dump( urlencode($var) );
var_dump( urlencode( $comp_me ) );
Expected result:
----------------
I would expect to see 2 urlencoded strings, EXACTLY the same.
Actual result:
--------------
string(42) "x%DAs%CE%CF-%28J-.V%C8M%05%5C0%19%BD%04%3F"
string(41) "x%DAs%CE%CF-%28J-.V%C8M%05%00%19%BD%04%3F"
---------------------------------------^^^
PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Thu Oct 30 14:00:01 2025 UTC |
I've still got this problem. (this was not the subject of the below conversation) 11:51 < rasmus> main/php_variables.c has the php_default_treat_data() function which implements the actual default string parsing logic in PHP. And no, you can't change it. It would break every PHP app ever written ... 11:52 < rasmus> the point is that it isn't broken 11:53 < rasmus> and if you think it is, then you are simply wrong. 11:53 < EvanCarroll> http://www.google.com/search?q=site%3Abugs.php.net+parse_str&ie=utf-8&oe=utf-8&aq=t&rls=com.ubuntu:en-US:unofficial&client=firefox-a 11:54 < rasmus> your point? 11:54 < rasmus> those are all people who don't understand how to use it 11:54 < rasmus> like I said, it is exactly the same code as PHP uses to parse incoming user data 11:55 < rasmus> and it adheres to all the same rules Apparently, not reviewing the bug tracker is an indicator that everyone else doesn't know what they're doing. 32bit buildRunning the above code on my Ubuntu Jaunty 32bit does *not* exhibit the reported behaviour: Linux puffy.pgregg.com 2.6.28-11-server #42-Ubuntu SMP Fri Apr 17 02:48:10 UTC 2009 i686 GNU/Linux PHP 5.2.8 with Suhosin-Patch 0.9.6.3 (cli) (built: Jun 7 2009 22:28:42) Copyright (c) 1997-2008 The PHP Group Zend Engine v2.2.0, Copyright (c) 1998-2008 Zend Technologies with Suhosin v0.9.24, Copyright (c) 2007, by SektionEins GmbH string(41) "x%DAs%CE%CF-%28J-.V%C8M%05%00%19%BD%04%3F" string(41) "x%DAs%CE%CF-%28J-.V%C8M%05%00%19%BD%04%3F"