PHP encoding the POST input-CodePudding

I have a PHP code as shown below in which on POST call, I am getting encrypted value instead of the character. For example, on entering Hello World' I get this Hello World&#39; instead of Hello World' on console (from Line Z).

In the form_validator.php, I am using the following:

if (isset($_POST["response"]))
    $response = $_POST["response"];
print_r($response);

In the form.php, I have the following code:

<form id="acbdef" name="abcdef" action="#" method="post">
  <table width="100%" >
    <tr>
      <td>
        <?php echo SECRET_RESPONSE;?>:
      </td>
      <td colspan="2"><input type="text" id="response" name="response" value="" /></td>
    </tr>
  </table>
</form>

<script>
  // Test all the fields in another php page using javax and receive the result by JSON
  $("#save").click(function () {
    $.post('form_validator.php', $("#abcdef").serialize(), function (data) {
      console.log(data); // Line Z
    });// end function(data)
  });
</script>

In the config.php, I have the following:

$_GET = filter_input_array(INPUT_GET, FILTER_SANITIZE_STRING);
$_POST = filter_input_array(INPUT_POST, FILTER_SANITIZE_STRING);
$_REQUEST = (array) $_POST   (array) $_GET   (array) $_REQUEST;

Problem Statement :

I am wondering what changes I need to make in the php code above so that it takes the character itself instead of HTML coded apostrophe.

CodePudding user response：

The problem is in your config.php where you have the following line:

$_POST = filter_input_array(INPUT_POST, FILTER_SANITIZE_STRING);

This will HTML-encode single and double quotes in the input, as defined in chapter Sanitize filters:

FILTER_SANITIZE_STRING

Strip tags and HTML-encode double and single quotes, optionally strip or encode special characters. Encoding quotes can be disabled by setting FILTER_FLAG_NO_ENCODE_QUOTES. (Deprecated as of PHP 8.1.0, use htmlspecialchars() instead.)

If you don't want to convert any single or double quotes in their respective HTML-encoded strings, then use the flag FILTER_FLAG_NO_ENCODE_QUOTES or don't use the FILTER_SANITIZE_STRING filter (it is deprecated anyway).

CodePudding user response：

You seems to be serializing the input. In jquery before you send it to your php. You will need to decode it before you print it.

Check out https://www.php.net/manual/en/function.html-entity-decode as a place to start