Take the 2-minute tour ×

I am trying to pass a url for creating an iframe as a parameter of a query string. Because the url that I am passing contains an ampersand, I encode the url with 'urlencode' then append it to the query string.

$url = "http://www.somesite.com/index.php?option=content&view=article&id=1234:some+article";
$url_encoded = urlencode($url);

<a href="http://www.mysite.com/external_article_iframe/?url=<?php echo $url_encoded ?>" target="_blank"></a>

On the page where I want to create the iframe, I retrieve the url parameter using the $_GET variable.

$iframe_source = $_GET[$url];

<iframe id="external-link-frame" src="<?php echo $iframe_source ?>"></iframe>

However $_GET only retrieves the part of the parameter value up to the encoded ampersand.

<?php echo $_GET[$url]; //outputs http://www.somesite.com/index.php?option=content ?>

What must I do in order to send the entire url including the parameters that are part of its own query string.

UPDATE: I am able to do it by encoding the url twice


Take a look at: http://stackoverflow.com/a/2433211/1359529

share|improve this question
And what's the final url? PS: your code is one huge XSS vulnerability –  zerkms Jun 5 '12 at 23:45
Should this not be echo $_GET['url'] rather than $_GET[$url]? –  Michael Berkowski Jun 5 '12 at 23:47
Hey Zerkms, Not sure what you mean by final url? Also, please tell me more about how to avoid XSS holes. I don't understand how such attacks work. –  Brandon Brown Jun 5 '12 at 23:48
You probably also need to decode it before you add it as the src of the iframe. –  John V. Jun 5 '12 at 23:49
Thanks Michael, I meant to echo the $iframe_source variable. Thanks Alex. I'm confused about decoding though because I cannot get the entire url to decode it. If I try to retreive it from $_GET and then decode for example, $iframe_source = urldecode($_GET['url']), I'll still only have the part the preceeds the ampersand. Does that make sense or am I missing something? –  Brandon Brown Jun 5 '12 at 23:53
show 1 more comment

2 Answers

I think rawurlencode() will encode the ampersands too.


share|improve this answer
Thanks, Scott. Gonna try this now. –  Brandon Brown Jun 5 '12 at 23:59
No luck. Thing is urlecode is replacing ampersands with '%26' but some how get is still interpreting those as param separaters. –  Brandon Brown Jun 6 '12 at 0:04
GET is too smart. You could always use base64_encode(): us.php.net/manual/en/function.base64-encode.php –  Scott Saunders Jun 6 '12 at 0:24
add comment

I believe, how you append it, the $_GET function thinks that the ampersand signs are signifying new values to get. I bet if you did after that $iframe_view = $_GET[$view] it will output article.

If you want it to get the full URL, I think it's best to encode by replacing & signs with something else and then once you get the url, then replace them back to & signs.

share|improve this answer
Hey Richard, Thanks. That's true about the $_GET[$view]. Thing is, I am actually doing all of this dynamically for an unknown url so I can't convert the ampersands manually. I need a solution that works for every url. –  Brandon Brown Jun 5 '12 at 23:58
Well even if you don't know the URL, going through and string replacing the & should work, I'm confused why you don't think this will work? In general the reason the get isn't working is because the HTTP request is figuring that each & is signifying a new GET variable and therefore your problem. If you replace & with a specific string sequence, then you should have no problem. Something like @@!!## might work out because really the chances of that being in a url? I shall keep watching this I guess for a solution though. Good luck! –  richardhsu Jun 6 '12 at 0:08
add comment

Your Answer


