title: Send XMLHttpRequest containing script-tags
body: <p>So, I've built my own rudimentary CMS, that contains a backend page where admins can input stuff like page title, description, social media profiles, and so on. I have also made inputs for code injections in head and body – meant for tracking. I'm saving the form data by making it into a string and posting it with a XMLHttpRequest to a PHP file. To make the data into a string I use base64 encoding. However – while text, urls, and simple html markup works fine, this does not play well with quotation marks or script tags. They either produce malformed characters after they are inserted, or they seem to prevent the string from being inserted at all. Does anybody have an idea about how to achieve this?</p>
  
  <p>Here is the relevant part of my javascript:</p>
  
  <pre><code>const request = new XMLHttpRequest();    
  siteInfo.addEventListener('submit', function (e) {
    e.preventDefault();
    let trackingHead = btoa(codeEditorHead.getValue());
    let trackingBody = btoa(codeEditorBody.getValue());
    let requestString = 'tracking-head=' + trackingHead + '&amp;tracking-body=' + trackingBody;
    request.open('POST', '/includes/update-siteinfo.php', true);
    request.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded; charset=UTF-8');
    request.send(requestString);
  });
  </code></pre>
  
  <p>Oh, and btw, I use CodeMirror for the input field, hence the getValue function.</p>
  
  <p>Here is the corresponding PHP:</p>
  
  <pre><code>if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    if (!empty($_POST['tracking-head'])) {
      $trackingHead = base64_decode($_POST['tracking-head']);
    }
    if (!empty($_POST['tracking-body'])) {
      $trackingBody = base64_decode($_POST['tracking-body']);
    }
  }
  </code></pre>
  
  <p>After this is some error handling and the insert statement. Obviously none of my error handlers fires, which leads me to beliveve the issue is in the javascript request and not in the php.</p>
  
  <p>Is this an encoding issue? Am I using the wrong headers? Is base64 the best way to stringify code? Or have I perhaps misunderstood something fundamental about how XMLHttpRequests works? ¯\_(ツ)_/¯</p>