'Is there a way to escape `]` PHP <input name="array[with-text-keys]"> notation?
I am maintaining a legacy PHP application which uses many string indexed arrays as ipnut names. There are many snippets similar to this:
<input name="<?=
htmlspecialchars(
'array_name[' . $string_index . ']',
ENT_QUOTES
); ?>"
/>
This worked pretty well for a few years until someone used a_string_with[square_brackets] as $string_index.
This value broken the app as it was send to the server as:
array_name[a_string_with[square_brackets]]=value
...which was interpreted by PHP as var_dump($_POST):
array (size=1)
'array_name' =>
array (size=1)
'a_string_with[square_brackets' => string 'any_value' (length=9)
Notice the missing closing square bracket ] in the array key. It seems that second square bracket (and everything that follows it) is silently ignored by php.
I have searched for a while, and could not find a way to escape the closing bracket that would be automaticly interpreted by php when parsing request.
I have decided to replace this keys with base64 encoded values, but I wonder if PHP really does not have such feature?
Minimal example Just create a file contining one php line:
<?php
var_dump($_GET);
... and call it:
http://localhost/var_dump.php?array_name[a_string_with[square_brackets]]=any_value
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|
