PHP/HTML Error - Illegal Character

Question

So i'm trying to make a website without having any errors, however i keep getting this error:

line 31 column 107 - Error: Bad value display.php? url=A GUIDE TO THE PROJECT MANAGEMENT BODY OF KNOWLEDGE for attribute href on element a: Illegal character in query: not a URL code point.

And this is the part of the code that it is highlighting that is giving the error:

</tr><tr><td><a href='display.php? click=A GUIDE TO THE PROJECT MANAGEMENT BODY OF KNOWLEDGE'>

The '>' the symbol on the end is being highlighted, and it is repeating this for every row.

This is the line of the source code that is saying that is causing the error:

$book = $row['bookTitle'];
echo "<td><a href='display.php? url=".$book."'>\n" .$book."</a></td>";

Any ideas of how to stop this? Any help is appreciated :)

echo '<td><a href="display.php?url='.$book.'">'.$book.'</a></td>'; — MH2K9
– MH2K9, Commented Nov 24, 2014 at 15:52
Is that the actual generated HTML or something already rendered (such as your browser's DOM pane)? — Álvaro González
– Álvaro González, Commented Nov 24, 2014 at 15:59
Thats the code that I've written. If that's what your asking? — user4282145
– user4282145, Commented Nov 24, 2014 at 16:04

Tim · Accepted Answer · 2014-11-24 15:50:20Z

3

Your a tag has a space before the query string parameter:

<a href='display.php? url=".$book."'>

this should be:

<a href='display.php?url=".$book."'>

answered Nov 24, 2014 at 15:50

Tim

3261 silver badge7 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

user4282145 Over a year ago

Thanks, just gave that a go but i'm still getting the same error, saying that im using an illegal character '>'

Tim Over a year ago

try removing all the spaces from the query string using str_replace(' ', '-', $book) in place of $book - that may be confusing things

Álvaro González · Accepted Answer · 2014-11-24 16:06:09Z

1

I'm not fully sure of the exact reason for the error but you're injecting raw random input into both a URL and an HTML document. You need to escape them properly:

For URLs: rawurlencode()
For HTML: htmlspecialchars()

Please note that the value of the href attribute contains a URL that's injected into HTML so you need both escaping mechanisms:

$book = $row['bookTitle'];
echo "<td><a href='display.php?url=" . htmlspecialchars(rawurlencode($book)) . "'>\n" .
    htmlspecialchars($book) . "</a></td>";

I've also fixed what I assume is a little typo (you probably expect $_GET['url'] rather than $_GET[' url']).

answered Nov 24, 2014 at 16:06

Álvaro González

147k45 gold badges282 silver badges378 bronze badges

Collectives™ on Stack Overflow

PHP/HTML Error - Illegal Character

2 Answers 2

2 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related