'Is there a way to escape `]` PHP <input name="array[with-text-keys]"> notation?

I am maintaining a legacy PHP application which uses many string indexed arrays as ipnut names. There are many snippets similar to this:

<input name="<?= 
    htmlspecialchars(
        'array_name[' . $string_index . ']',
        ENT_QUOTES
    ); ?>" 
/>

This worked pretty well for a few years until someone used a_string_with[square_brackets] as $string_index.

This value broken the app as it was send to the server as:

array_name[a_string_with[square_brackets]]=value

...which was interpreted by PHP as var_dump($_POST):

array (size=1)
  'array_name' => 
    array (size=1)
      'a_string_with[square_brackets' => string 'any_value' (length=9)

Notice the missing closing square bracket ] in the array key. It seems that second square bracket (and everything that follows it) is silently ignored by php.

I have searched for a while, and could not find a way to escape the closing bracket that would be automaticly interpreted by php when parsing request.

I have decided to replace this keys with base64 encoded values, but I wonder if PHP really does not have such feature?

Minimal example Just create a file contining one php line:

<?php
var_dump($_GET);

... and call it:

http://localhost/var_dump.php?array_name[a_string_with[square_brackets]]=any_value
php


Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source