Question

I have this small PHP script that takes a POST variable and writes it out to a file.

<?php
   $fileContents = $_POST["Contents"];
   $fileName = $_POST["Name"];
   $filePath = $_POST["Path"];

   $passcode = $_POST["Passcode"];

   if ($passcode != "<passcode>")
      die();

   if (!is_dir("./upload/$filePath"))
      mkdir("./upload/$filePath", 0755, true);

   $file = "./upload/$filePath" . $fileName;

   $fd = fopen($file, "w");
   fwrite($fd, $fileContents);
   fclose($fd);
?>

This seems to work fine for most text given, but in the event where text containing a percent sign (%) is given, the following oddity occurs:

fivice = getField( %bind, 0 );

The original text was:

%device = getField( %bind, 0 );

I send the POST request with the following server request:

POST path/to/Upload.php HTTP/1.1\nHost: host.com\nContent-Type: application/x-www-form-urlencoded\nContent-Length: <length>\n\n<file data>\n

This also occurs with many other cases, but, as you can see, not with %bind.
I looked for the cause of this and found something on %%, so I tried a %%-escaper and got this:

%fivice = getField( %%bind, 0 );

Is there any way to fix this % problem? Also, is the % problem a php issue or a request issue?

Edit: I tried using urlencode / urldecode but those both failed to fix the problem. This also occurred with file_put_contents, so I’m starting to think it’s an upload problem.

Answer 1

The way to fix it is to URL-encode the text, which will turn % into %25. You’ll need to investigate where it needs to be encoded though (or why it’s not being encoded in the first place).

>>> u'fi'.encode('macroman')
'\xde'