Can someone please tell me how to escape an ampersand in PHP?

Question

I have a wysiwyg editor that is changing my ampersand characters from & to &

What happens when the data is submitted is that everything after the & is dropped and everything before is left intact. I asked this question a while back but couldn't seem to get an answer. We thought that maybe it was the editor but I verified that the ampersand is being converted after submission. Is there a php function that will escape these ascii characters?

Answer 1

are you able to print_r() the raw contents as they are submitted to verify that PHP is getting the whole string?

If your editor is chopping it off at the ampersand then it's a problem before PHP is involved.

Answer 2

It sounds like it's not being urlencoded properly. Are you building the request yourself (using AJAX for example)?

Depending on the AJAX library you're using (if any) you may need to manually escape your data:

Imagine your editor contains "Beans&sausages". You post this in the variable "text":

text=Beans&sausages

This looks to PHP like

text = Beans
sausages = null

In Javascript use encodeURIComponent() to fix this.

Answer 3

I think the problem here is somewhere else, since what the editor does is absolutely correct. I would suggest checking the value received by PHP (the one in the $_REQUEST array), if that has missing characters, check the POST or GET request that is sent on the wire (i.e. use firebug or similar). I would think that the value is mangled before it is sent.

Answer 4

Perhaps somewhere the function htmlentities is or isn't being called on your text? You can use html_entity_decode to decode it back. Having read most of the responses and your question again though, I would look at the code submitting the AJAX, you most likely need to urlencode the string in javascript before passing it as post data. Most libraries will handle this for you. The function encodeURIComponent should be called on the data if you are assembling it manually.

var postData = encodeURIComponent(key) + '=' + encodeURIComponent(value).replace(/%20/g,'+');

I noticed in one of your comments you were using a jQuery function. jQuery has a helper function called $.param() that will encode a postable string for you, or even easier is just to pass an object to the data parameter of the ajax call (internally it will be passed through $.param()

$.ajax({
  method:'POST',
  url: '/somefile.php',
  data: {
    rt: $("textarea#rt").val(),
    Type: 1,
    //.... more data here
  },
  success: function(data) {
  }
});