How to post special/reserved characters from HTML forms to PHP pages?

Question

I have a form that looks like this:

<form action="/assesment/savelist/" method="post">
    <input type="hidden" name="owner" value="<?php echo $userid ?>" />
    <input type="text" name="title" value="Question List Title" />
    <textarea name="description"></textarea>
    <input type="submit" />
</form>

In the description people will have to be able to use the £ character (among other non-allowed characters).

Is there anyway to convert these characters to something that is allowed before posting them to my PHP page?

---

Hi All, thanks for your comments so far.

If I do print_r($_POST) on my "savequestion" it outposts the postdata that gets sent to it from that form.

however, if there is a £ in any of the fields then that specific character doesnt get sent. For example if I was to post "sdfsdfs £ adasd" from that form all that would get sent is "sdfsdfs adasd"

the question is how do I convert the £ to something that I can send as post data from a HTML form.

Polythene

Have you tried htmlspecialchars()? – Pitt

"£" is allowed just fine. What problem do you have with sending it? – Delphinedelphinia

@Pitt you use £ when you fill out web forms ? – Melodics

All other characters seam to send fine... When I try submitting that the form breaks. Hi Matt, I am unsure how to use htmlspecialchars() to convert before the form is sent. – Polythene

what do you mean by allowed and not-allowed? – Trencherman

How does it break? Describe your problem. The solution you are looking for is going in the wrong direction. – Delphinedelphinia

@chris $description = htmlspecialchars($_POST['description']); although bear in mind that this will convert other characters as well. Personally I'd store everything un-converted, then convert on output. – Metre

@Pitt That's a bad solution for something that's not a real problem. You just need to handle encodings correctly. – Delphinedelphinia

BEFORE posting implies using javascript. Why not process it AFTER posting with the PHP functions mentioned here – Bozcaada

Read: Handling Unicode Front To Back In A Web App – Delphinedelphinia

The sane way is to encode special characters only when displaying them. – Melodics

@Melodics But this is not about display. It is about input. – Timework

I'm pretty sure it is, because he is looking at it in some way and it is probably not escaped/encoded the correct way. HTML escaping data before putting it in a database (or whatever storage) is a very bad idea. On that note... @Chris how did you determine that the character is forbidden ? – Melodics

Hi All, thanks for your comments so far. If I do print_r($_POST) on my "savequestion" it outposts the postdata that gets sent to it from that form. however, if there is a £ in any of the fields then that specific character doesnt get sent. For example if I was to post "sdfsdfs £ adasd" from that form all that would get sent is "sdfsdfs adasd" the question is how do I convert the £ to something that I can send as post data from a HTML form. – Polythene

For anybody looking to manually escape encode special characters there's this - encodeURIComponent() – Madel

Answer 1

WIN!

The solution is to add accept-charset="utf-8" to the form tag.

I didnt have the option to add this to the header of the page but adding it to the form tag solved all my issues. Big shout out to @deceze for posting a link to this website http://kunststube.net/frontback/

Polythene

You might want to check the encoding of the page itself too. – Melodics

Answer 2

Browsers will automatically encode data when it is submitted via the standard form submit mechanism.

PHP will automatically decode data when it populates $_POST/GET/REQUEST.

You don't need to do anything at that stage.

You might need to encode the data before inserting it into a database / some HTML / an email / a URI / some other data format, but that would depend on what you are doing with the data.

Ballroom

What if the PHP instance does not support/use unicode? (How are non-ASCII characters be handled then?) – Timework

@pst by default the browser encodes post data using the page encoding. If you don't support unicode the page encoding will not be unicode. – Melodics

@Melodics Neat. I never knew that. – Timework

Answer 3

Browsers will 'automatically' "encode" <> data when it is submitted via the standard form submit mechanism.

Pa