Strip Apostrophes from URL

Question

[EDIT] I am placing the comment I entered near the bottom of this post to, hopefully avoid further down votes. This was a pretty basic question stemming from my misunderstanding of what exactly $_REQUEST is. My understanding was that it was an index that referenced $_POST and $_GET (and $_COOKIE). However, I found that $_REQUEST is, itself, an array, so I simply changed the variables in $_REQUEST. Not an optimal solution, but a solution, nonetheless. It has the added advantage that the $_GET variables, with the apostrophes still there, are available. Perhaps not the best practice, but please note before you down vote that I have very little control over this data - coming in from one API and going out to another.

I have an API currently in use. We have a problem with some customers sending apostrophes in the URL. My question is how best to strip the apostrophes within the URL array. Perhaps using array_walk or something similar?

So that $_REQUEST[Customer] == "O'Henry's"
Becomes $_REQUEST[Customer] == "OHenrys"

EDIT: Judging from some of the answers here, I believe I need to explain a little better. This is an API that is already written and is the preliminary interface for another AS400 API. I have nothing to do with building the URL. I am receiving it. All I am concerned about is removing the apostrophes, without changing any other code. So the best way is to go through the array. In the body of the code, the variable references are all using $_REQUEST[]. I COULD go in and change those to $_GET[] if absolutely necessary but would rather avoid that.

This Works

foreach($_REQUEST as $idx => $val)
{
    $_REQUEST[$idx] = str_replace("'" , '' , $val);
}

However, I am a little leery of using $_REQUEST in that manner. Does anyone see a problem with that. (Replacing $_REQUEST with $_GET does not work)

Answer 1

For some use cases, it might make sense to store a "clean" or "pretty" version of the name. In that case, you may want to standardize to a case and have a whitelist of characters rather than a blacklist consisting of just single quotes. Use a regex to enforce this, perhaps similar to this one:

preg_replace("/[^[:alnum:][:space:]]/u", '', $string);

If you do that, consider if it is necessary to differentiate between different customers named O'Henrys, O'Henry's, OHenrys, O'henry's, and so on. Make sure your constraints are enforced by the app and the database.

The array_walk_recursive function is a reasonable way to hit every item in an array:

function sanitize(&$item, $key)
{
    if (is_string($item)) {
        // apply whitelist constraints
    }
}

array_walk_recursive($array, 'sanitize');

It's hard to tell without more context, but it seems possible you may be asking the wrong question / solving the wrong problem.

Remember that you can almost always escape "special" characters and render them a non-issue.

In an HTML context where a single quote might cause problems (such as an attribute value denoted by single quotes), escape for HTML using htmlspecialchars or a library-specific alternative:

<?php
// some stuff
$name = "O'Henry's";
?><a data-customer='<?=htmlspecialchars($name, ENT_QUOTES|ENT_HTML5);?>'>whatever</a><?php
// continue

For JavaScript, encode using json_encode:

<?php
// some stuff
$name = "O'Henry's";
?><script>
    var a = <?=json_encode($name);?>
    alert(a); // O'Henry's
</script>

For SQL, use PDO and a prepared statement:

$dbh = new PDO('mysql:host=localhost;dbname=whatever', $user, $pass);
$name = "O'Henry's";
$stmt = $dbh->prepare("INSERT INTO REGISTRY (name) VALUES (:name)");
$stmt->bindParam(':name', $name);
$stmt->execute();

For use in a URL query string, use urlencode:

<?php
// some stuff
$name = "O'Henry's";
?><a href="https://example.com/path/?var=<?=urlencode($name);?>">whatever</a><?php
// continue

For use in a URL query path use rawurlencode:

<?php
// some stuff
$name = "O'Henry's";
?><a href="https://example.com/clients/<?=rawurlencode($name);?>/reports/">whatever</a><?php
// continue

Libraries and frameworks will provide additional ways to escape things in those and other contexts.

Answer 2

If you want them removing altogether as an illegal character:

<?php foreach($myArray as $idx => $val){ 

    $myArray[$idx] = str_replace("'" , '' , $val);

 }
 ?>

However this shouldn't be your solution to SQL Inserts etc.. Better off using mysqli::real_escape_string OR prepared statements

Answer 3

EDIT:
Reading the edits you made on your question, the best solution for you is str_replace(). But no need to loop through your array, the 3rd parameter can be an array !
This will strip apostrophes of every item in $foo:

$foo = [
    "O'Henry's",
    "D'Angleterre"
];
$foo = str_replace("'", "", $foo);

---

If you really need to remove the apostrophes use str_replace():

$foo = "O'Henry's";
$foo = str_replace("'", "", $foo);
// OUTPUT: OHenrys

If you can keep them, you better encode them. urlencode() may be a way to do:

$foo = urlencode($foo);
// OUTPUT: O%27Henry%27s

If you build this URL from an array you could use http_build_query():

$foo = [
    'Customer' => "O'Henry's"
];
$foo = http_build_query($foo);
// OUTPUT: Customer=O%27Henry%27s

Answer 4

This was a pretty basic question stemming from my misunderstanding of what exactly $_REQUEST is. My understanding was that it was an index that referenced $_POST and $_GET (and $_COOKIE). However, I found that $_REQUEST is, itself, an array, so I simply changed the variables in $_REQUEST. Not an optimal solution, but a solution, nonetheless. It has the added advantage that the $_GET variables, with the apostrophes still there, are available. Not the best practice, though.