Question

My friend has been playing around with some language stuff on our site and our file names are being out put with these characters now. Usually I’d wait for him to wake up but this is a pretty big issue as we are getting e-mails through about the weird characters in the file names.

You don’t see the characters when echoed in HTML, but we have the names being output to a header, which does show the characters, like so:

header('Content-Disposition: attachment; filename="'.$title.'.'.strtolower($type).'";');

How can we avoid these characters from displaying? They are also being input to our database, file names such as ‪asdfmovie‬‏ – I have googled the codes but I can’t find any results for them.

Does anyone know what they are? and how to avoid them?

Thank you

Answer 1

These are HTML entities which can be decoded using html_entity_decode, like echo html_entity_decode($str, ENT_COMPAT, 'UTF-8').

It’s wrong to store such values in the database though, as you are seeing. The values should be stored in their original form and only HTML entity encoded when necessary for outputting to HTML. Figure out where they’re being HTML encoded and fix that. If you already have a database full of this nonsense… um, have fun reversing it. :o)