Trouble understanding htmlspecialchars to change '&' to '&' in a variable

[TecTao]

I'm passing a variable from one page to the other using $_GET.  For example the variable is 'This Thing & That Thing'.  Echoing the the variable there is only 'This Thing'.  The '& That Thing' is lost.

 

I understand this is happening from because the ampersand is an HTML code and needs to be replaced with '&' .

 

The code I have is

 

$this = $_GET ['this'];

$thisCleaned = htmlspecialchars($this);

echo $thisCleaned;

 

But it is still loosing the string after the ampersand.  I must not be defining the htmlspecialchars correctly. 

[floridaflatlander]

Is "$this = $_GET ['this'];" on another page/file.

[TecTao]

Yes, the variable this is passed from another page.

[floridaflatlander]

How do you get your info to the destination page? Using something like <form action="destination.php" method="post" >

[TecTao]

yes the variable is passing just fine, it's not in a form but a hyperlink with different variables.

It's the ampersand in the variable name and the loss of the second part of the variable after the ampersand I'm having trouble understanding.

[TimeBomb]

yes the variable is passing just fine, it's not in a form but a hyperlink with different variables.

It's the ampersand in the variable name and the loss of the second part of the variable after the ampersand I'm having trouble understanding.

 

Ah, this has to do with what makes a GET request, specifically the symbols used in the URI.

 

First off, when we var_dump $_GET with the aforementioned string, we get:

array(2) { ["tmp"]=> string(11) "This Thing " ["That_Thing"]=> string(0) "" }

 

The URI I used was /?tmp=This Thing & That Thing.

Or, in other words... /?key1=value&key2.

The ampersand is a GET variable seperator. The first GET var is designated by the question mark symbol, but all GET variables following that are separated by the ampersand.

 

The Solution

An ampersand intended for visual purposes is escaped in a URL as %26.

[floridaflatlander]

I don't know if this will help but urlencode().