与号作为 & 发送而不是 & 尝试更新 MySQL 数据库时

Question

I am currently building an "admin" section where the information shown on the main site can be added to, updated and deleted using this one page.

All of my scripts function as intended, information is added to the database, rows are updated and deleted with no errors in 99.9% of cases.

The database is set up with 3 columns TITLE, DESCRIPTION and Image and when updating any of the rows I use the value in TITLE as my reference for WHERE statements.

However, any title containing an '&' symbol are downloaded fine and insert into my HTML as intended, however when being sent to my update script they are sent as &. This then doesn't register correctly with the update script and then it fails to update. I know '&' is converted to '&' when escaped but cannot understand why there is a second 'amp;' being sent?

Can anyone shed some light on this / point me to appropriate documentation to solve this issue?

Javscript Function(dbtable and titler are variables that decide the table to insert into )

    function updating(indexno) {
                var current = document.getElementById('title'+indexno).innerHTML;
                var newtitle = document.getElementById('titlelink'+indexno).value;
                var newdesc = document.getElementById('desclink'+indexno).value;
                var newimage = document.getElementById('imagelink'+indexno).value;
                if(newtitle == ""){
                    newtitle = document.getElementById('title'+indexno).innerHTML;
                };
                if(newdesc == ""){
                    newdesc = document.getElementById('description'+indexno).innerHTML;
                };
                if(newimage == ""){
                    newimage = document.getElementById('image'+indexno).innerHTML;
                }
                var request = "updatingdb.php?newtitle="+escape(newtitle)+"&newdesc="+escape(newdesc)+"&newimage="+escape(newimage)+"&currenttitle="+escape(current)+"&thetable="+escape(dbtable);
                var xhr = new XMLHttpRequest();
                xhr.open("GET", request);
                xhr.onreadystatechange = function () {
                    if (xhr.readyState == 4 && xhr.status == 200) {
                        console.log(xhr.responseText);

                    }
                };
                xhr.send(null);
                thetester(dbtable,titler);
    }

PHP Script

    $thetable = htmlentities($_GET['thetable']);
            $currenttitle = htmlentities($_GET['currenttitle']);
            $newtitle = htmlentities($_GET['newtitle']);
            $newdesc = htmlentities($_GET['newdesc']);
            $newimage = htmlentities($_GET['newimage']);

            $db = mysqli_connect($servername, $user, $password);

            if (!$db)
                {
                    echo"NO CONNECTION AVAILABLE";
                    exit();
                }

            mysqli_select_db ($db, "testing");

            $query ="UPDATE `$thetable` SET `TITLE`= '$newtitle', `DESCRIPTION` ='$newdesc', `IMAGE` = '$newimage' WHERE `TITLE` = '$currenttitle'";

            echo$query;

            $results = mysqli_query($db, $query);


            if(!$results)
                {
                    echo"not working";
                    exit();
                }

            echo"updated";

Answer 1

This happens because you use htmlentities() , which will just see the & character and therefore makes an entity out of it. You could either remove htmlentities from the desired input field or do something like this:

$value = str_replace('&', '&', htmlentities($value));

or (better imo)

$value = htmlentities(html_entity_decode($value));