rawurlencode() does not convert the '%' character to '%25' althought this character is specified in RFC1738 as unsafe thus it has to be converted to '%25'.

This is a serious leak if you use rawurlencode() and rawurldecode().

For example the code snippet

$a = rawurlencode("%berg%");
print rawurldecode($a);

produces a

?rg%

instead of

%berg%

Since I've been using rawurlencode()/rawurldecode() pairs in many different scripts that work on a lot of different sites I sit on a bomb now because I don't know when the first character string like '%be' or '%12' will be misinterpreted.

BTW: How about founding rawurlencode() on the more accurate RFC2396 that on 1738?

Bye
Martin Kadlec