keeping single-quotes in http_build_query()?

Question

I'm wanting to use http_build_query to change an array to html tag properties. Problem is, it's changing my single-quoted values into %27. So if I have

http_build_query( array("type"=>"'hidden'", ... ), '', ' ' );

I get

<input type=%27hidden%27 ...>

How can I get around this?

Answer 1

I guess you could get around this doing a rawurldecode() on the result, but this really isn't what http_build_query was intended for. And won't it put a & between the name/value pairs anyway, making the output unusable as a input element?

You could use one of the XML classes to do this but I'm not sure it's worth the effort. Where are you using this?

Answer 2

you could add urldecode() in front of the http_build_query

like:

<?php
     urldecode(http_build_query( array("type"=>"'hidden'", ... ), '', ' ' ));
?>

Answer 3

http_build_query() was designed to turn an array of parameters into a URL. Not to build an HTML tag. You can do a few things:

1. Add it all manually

   <input type="<?php echo htmlspecialchars($array['type']); ?>" ...
   

2. Build a helper function

   function buildArgs($array) {
       $ret = '';
       foreach ($array as $key => $value) {
           $ret .= ' ' . htmlspecialchars($key, ENT_QUOTES) . '="' . htmlspecialchars($value) . '"';
       }
       return trim($ret);
   }
   
   
   <input <?php echo buildArgs(array('type'=>'hidden', 'name'=>'foo')); ?>>
   

Would yield you:

    <input type="hidden" name="foo" >