Question

I am trying to send a simple URL request to a server with XML with something along the lines of

xmlhttp.open("GET","serverFile.php?q="+str,true);
xmlhttp.send();

I have three variables contained in the javascript file, i.e.:

var userName = Steve;
var findtype = Green Holder;
var findcategory = B Provincial;

I was of trying to “package” the strings together into somewhat

var combinedString = "find&userName=" + userName + "&type=" + findType + "&category=" + findCategory;

and then calling the function above

xmlhttp.open("GET","serverFile.php?q="+combinedString,true);

but I’m confused how to decode this on the server side or whether this would work at all. I was originally thinking of having an if statement:

$q=$_GET["q"];
if ($q == "find")
{
    $name=$_GET["userName"];
    $type=$_GET["type"];
    $category=$_GET["category"];
    ...do other coding here to get data
}

But I’m very new to PHP so I have no idea if this is the right approach. I was trying to figure out appropriate URL encoding online but is the combined string in the appropriate form? Would the “&” appropriately divide the contents or would I need & and would I need to place a plus sign between spaces or would it do that by itself? Any information would be helpful!

Answer 1

You need to encode your URL components in JavaScript before you use string concatenation.

combinedString = ... + encodeURIComponent(userName) + ... + encodeURIComponent(findType) + ...

PHP will automatically fill $_GET with the url decoded values, so if you were to pass:

?foo=%2F%40%23%24

PHP would automatically decode $_GET['foo'] to equal "/@#$"

---

As for your & comment, you only ever need to escape XML when you’re using the value in XML (or HTML in this case, which is close but not quite identical).

If you’re simply typing in the browser’s location bar, you’d use:

somepage.php?foo=bar&fizz=buzz

But if you were marking this up in an anchor element (<a>) you’d use:

<a href="somepage.php?foo=bar&amp;fizz=buzz">lorem ipsum</a>