PHP curl trimmed 发送的数据

Question

I'm sending some key-value strings as post data with curl. I found that any semicolon is removed (according to target's request log). But just before I send the data, it still contain semicolon. Is there any input filtering in any curl operations below?

function curlPostShellExec($data, $url)
{
    $fields_string = '';
    foreach($data as $key=>$value)
    { 
        $fields_string .= $key.'='.$value.'&'; 
    }
    rtrim($fields_string, '&');

    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $url);
    curl_setopt($ch, CURLOPT_POST, count($data));
    curl_setopt($ch, CURLOPT_POSTFIELDS, $fields_string);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
    $result = curl_exec($ch);
    curl_close($ch);
    return $result;
}

Answer 1

Replace your semi-colons with %3A

Alternatively you could use urlencode() or as unclexo suggests http_build_query()

urlencode will encode your strings for safely transmitting via CURL or GET. And you can decode them on the otherside with urldecode

Eg.

urlencode(rtrim($fields_string, '&'));

Or you can replace your entire foreach block with:

$fields_string = http_build_query($data);