使用ajax发送特殊字符并将其正确接收到php

Question

i've got a javascript function which get some datas on parameter and try to save them on a postgreSQL database. This is the javascript ajax function

function insertCalendarEvents(calendar_group, event_name, event_datestart, event_datestop, event_timestart, event_timestop, event_info, onfinish) {
    var request;
    if(window.XMLHttpRequest)
        request = new XMLHttpRequest();
    else
        request = new ActiveXObject("Microsoft.XMLHTTP");

    request.onreadystatechange = function() {
        if (request.readyState == 4 && request.status == 200) {alert(request.responseText);
            if(request.responseText.substr(0, 6) == "error ")
                alert(errorName[request.responseText.substr(6)]);
            else {
                var event_id = 7;
                onfinish(event_id);
            }
        }
    }

    var params = "action=insertCalendarEvents&calendar_group=" + calendar_group + "&event_name=" + encodeURIComponent(event_name) + "&event_datestart=" + event_datestart + "&event_datestop=" + event_datestop + "&event_timestart=" + event_timestart + "&event_timestop=" + event_timestop + "&event_info=" + event_info;
    request.open("GET", "php/calendar.php?" + params, true);
    request.setRequestHeader("If-Modified-Since", "Sat, 1 Jan 2000 00:00:00 GMT");
    request.setRequestHeader("Content-type", "application/x-www-form-urlencoded; charset=UTF-8");
    request.send();
}

And this is the php function:

if($action == "insertCalendarEvents") {
$calendar_group = $_GET["calendar_group"];
    $event_name = "'" . htmlspecialchars(urldecode($_GET["event_name"])) . "'";
    $event_datestart = "'" . $_GET["event_datestart"] . "'";
    $event_datestop = "'" . $_GET["event_datestop"] . "'";
    $event_timestart = $_GET["event_timestart"] != "" ? "'" . $_GET["event_timestart"] . "'" : "null";
    $event_timestop = $_GET["event_timestop"] != "" ? "'" . $_GET["event_timestop"] . "'" : "null";
    $event_info = "'" . $_GET["event_info"] . "'";
    echo $event_name;

    require_once("connect.php");
$query = "INSERT INTO calendar_events (calendar_group, event_name, event_datestart, event_datestop, event_timestart, event_timestop, event_info) VALUES (" . $calendar_group . ", " . $event_name . ", " . $event_datestart . ", " . $event_datestop . ", " . $event_timestart . ", " . $event_timestop . ", " . $event_info . ")";
$result = pg_query($connect, $query);
if(!$result)
    die("error 1"); // query error

    $query = "SELECT currval('events_event_id_seq')";
    $result = pg_query($connect, $query);
    if(!$result)
    die("error 1"); // query error

    $row = pg_fetch_row($result);
    echo $row[0];
}

Problem is when i try to add special chars (right now i test only on event_name parameter) like + or newline and so, it doesnt work, on + it replaces it with space, newline doesnt do anything.

Answer 1

Encode Data Before You send to server

I also had problem like you have now but this function i implemented solved my problem

 function encode(val){
        var eVal;
        if(!encodeURIComponent){
            eVal=escape(val);
            eVal=eVal.replace(/@/g,"%40");
            eVal=eVal.replace(/\//g,"%2F");
            eVal=eVal.replace(/\+/g,"%2B");
            eVal=eVal.replace(/'/g,"%60");
            eVal=eVal.replace(/"/g,"%22");
            eVal=eVal.replace(/`/g,"%27");
            eVal=eVal.replace(/&/g,"%26");
        }else{
            eVal=encodeURIComponent(val);
            eVal=eVal.replace(/~/g,"%7E");
            eVal=eVal.replace(/!/g,"%21");
            eVal=eVal.replace(/\(/g,"%28");
            eVal=eVal.replace(/\)/g,"%29");
            eVal=eVal.replace(/'/g,"%27");
            eVal=eVal.replace(/"/g,"%22");
            eVal=eVal.replace(/`/g,"%27");
            eVal=eVal.replace(/&/g,"%26");
        }
        return eVal.replace(/\%20/g,"+");
    }

Answer 2

You need to pass the data through encodeURIComponent before adding it to the query string.

---

Also get rid of these lines:

request.setRequestHeader("If-Modified-Since", "Sat, 1 Jan 2000 00:00:00 GMT");

I'd be surprised if that was not always true.

request.setRequestHeader("Content-type", "application/x-www-form-urlencoded; charset=UTF-8");

You aren't making a POST request. There is no message body to describe the content-type of.

Answer 3

在通过Ajax发送参数之前，应在参数上使用encodeURI()

Answer 4

使用POST，它应该可以安全地传递您的数据，并且更合理地用于从客户端更新内容