Ampersand issue

[pasta]

Hi everyone,

Intermediate FM and PHP developer here. I've got a PHP document called contacts.php. It sends user input via PHP POST to another PHP document called contacts_submit.php, which then sends the posted data to my FileMaker database. This works just fine, except when an ampersand (&) is included in any of the users' inputs.

For example:

I have a field called ApplicantOrganization. If on contacts.php, they enter:

One and two and three and four

then that input is saved into my database exactly as entered, no problem. If, however, they enter:

One and two aaaaaa& three and four

then my database receives:

One and two aaaaaa

(I've tested PHP POST in isolation, and ampersands are sent just fine from one PHP document to another with no FileMaker involvement.)

Here's the relevant code on contacts_submit.php:

$request = $fm->newEditCommand('ApplicationOrgTypeRegion', $applicationOrgTypeRegionRecID);

$request->setField('ApplicantOrganization', $_POST['ApplicantOrganization']);

$request->execute();

As I said, writing to the database in all other cases is working wonderfully, so I know it's not a connection problem. It's an ampersand problem.



I thought that perhaps PHP and FileMaker encode/represent the ampersand character differently, and that's why the user input is being cut off upon encountering it. So then I tried using PHP's str_replace() function like so, thinking that there would be no problem if FileMaker received " and " instead of "&":

$request->setField('ApplicantOrganization', str_replace('&', ' and ', $_POST['ApplicantOrganization']));

However, the input still gets cut off where the ampersand character originally appeared in the user input. Finally, I tried placing the str_replace() function in the line above the setField() function (instead of nesting it within the setField() call), thinking that perhaps it wasn't executing first. That didn't change anything.



I also tried a few alternates:

$request->setField('ApplicantOrganization', str_replace('&', ' and ', $_POST['ApplicantOrganization']));

$request->setField('ApplicantOrganization', str_replace('%26', ' and ', $_POST['ApplicantOrganization']));

(The second one since I'm on a Mac).

I tried testing the str_replace() function independently in two similar documents, sending POST data from test1.php to test2.php and echoing it out on test2.php while replacing "&" with " and ". This worked as expected, i.e., an input of "one&two&three" on test1.php would echo out as "one and two and three" on test2.php.

I then decided to abandon str_replace() as an option, and have since looked into urlencode(), htmlentities(), htmlspecialchars(), and preg_replace(), but nothing has done the trick. FileMaker has yet to receive an ampersand character (or any input that follows one).

Does anyone have any suggestions? I've spent a few hours trying to remedy this problem, and am just about pulling my hair out now. Additionally, I haven't found similar cases on FMForums or elsewhere on the web. I'd really, really appreciate any help. Thanks.

Update: I just realized that although I'm working on a Mac, not all of the involved machines are Macs. My PHP code is sitting on a Mac server, and the FileMaker database is sitting on a Windows server. Would this affect how the ampersand character is encoded? Maybe I can still str_replace() it if I can figure out the correct encoding to detect.

[dansmith65]

have you tried looking at your value? Put this code right before your newEditCommand, and see what it holds.

print_r($_POST['ApplicantOrganization']);

die();

[pasta]

Update

Thanks for the response, dansmith65!

One complication: this system is actually live. So I can't use die() or else the experience of the users will be compromised. So I made a duplicate contacts.php document and sent it to a (two-line) test.php document. I ran the test that you suggested (although I had to do print_r($_POST) and print out the entire POST array to make it work), and the ampersands were preserved.

Then I tried going to the real contacts_submit.php and, instead of using print_r() and die(), I used mail() and sent myself an email containing the contents of the ApplicantOrganization field. Lo and behold! The ampersands were indeed cut off. I entered the string "Test & test & test & test" in the ApplicantOrganization field on contacts.php, which was then sent to contacts_submit.php, which then emailed me prior to editing the database. Here's the relevant code from contacts_submit.php:

$request = $fm->newEditCommand('ApplicationOrgTypeRegion', $applicationOrgTypeRegionRecID);

mail($myEmailAddress, 'boring email subject', $_POST['ApplicantOrganization']);

$request->setField('ApplicantOrganization', $_POST['ApplicantOrganization']);

$request->execute();

The email I received simply read "Test ".

I think you're onto something! Why would my (very simple) test.php document (which simply echoed out the contents of the received POST data), and my (more complicated) contacts_submit.php document (which does a whole lot more than echoing out the POST data, but it kinda does that too (via emailing me)) behave differently? Is it possible that something else on the contacts_submit.php document is interfering? I'm totally confused now.

[dansmith65]

I think that somewhere in your contacts_submit.php file the POST data is being manipulated.

When debugging like this, it's nice to not have to work with a live system. I use http://getfirebug.com/ and http://www.firephp.org/ in FireFox browser in this scenario. (but I only enable it for my IP, to prevent others with firebug from seeing my debugging info).

If you don't want to use that setup, the next method I use is random die() statements. If you can copy your entire contacts_submit.php file for testing, do that. Then, either start at the beginning of the file and work down to your $request->execute(); statement, or start there and work up to the beginning, looking for the point in the code that your POST data changes.

Sorry, I rely heavily on the documentation when I write php, and I didn't check it when I gave you the last code snippet. Try this instead, I think it'll work:

die($_POST['ApplicantOrganization']);