0

I'm working on an Android app which sends some hashes to the server. Of course, the hashes often contain special characters like + = /. I found out that my PHP script is automatically changing the + symbol with a blank space, which somehow breaches in my own security mechanism.

I could've simply replaced the blank space with the + sign using the str_replace() function, but I'm worried if there can be more circumstances like this where PHP changes some special characters with some other characters. Also, It's not the ethical way.

1) Is it only about the + symbol or there can be other occurrences too?

2) What is the correct way to get the raw (unformatted) string?

cht
  • 319
  • 3
  • 13

1 Answers1

1

As mentioned in my comment this is an encoding issue and should be fixed in the Request (Android app) rather than the server. Check this answer for a Java example.

To your specific questions:

  1. There are a number of "control characters" that NEED to be encoded because they have a special meaning: + ? &

  2. I don't think it's possible to get the original string in PHP, as PHP likely never sees it. The webserver will likely URL-decode the params before passing it to PHP, as defined in URL/HTTP.

Tobias K.
  • 2,997
  • 2
  • 12
  • 29
  • `str_replace()` is the naive server-side "solution" to your problem, however you figured out yourself that it's not ethical and error-prone. You just fix symptoms, not the problem. – Tobias K. Jul 14 '18 at 09:11