PHP converts form field characters to underscores

Do you have a question? Post it now! No Registration Necessary.  Now with pictures!

Threaded View

I'm currently writing a system which contains relatively arbitrary
form field names (the field names are re-used as headings in a
subsequent form-to-mail kind of script). I've noticed that PHP
converts certain form field-name characters to underscores.

After doing some searching for related bugs, these are the only entries I could find:

The first two responses cite the "because of register globals, any
form field which does not contain valid variable-name characters is
converted" whereas the last one points out where this really
contradicts itself, PHP accepts form field names with all manner of
non-printable characters _including_ form field names which start with
numbers. The following code writes a form to test which characters are
acceptable to PHP:

<form method="post">

    for ($i=1; $i<255; $i++) {
        print "<input type=\"hidden\" name=\"&#$i;\" />\n";

    <input type="Submit" />

if (count($_POST)) {
    for ($i=1; $i<255; $i++) {
        if (!isset($_POST[chr($i)])) {
            print $i.' ('.dechex($i).')(&#'.$i.';) doesnt exist<br />';


The sticking point for me is that space characters (%20) as well as
dot characters (%2E) are converted to underscores, yet all other ASCII
characters (with the exception of square brackets which at least have
some explainable meaning) are left as-is. I lose data because I can't
tell which fields had spaces, dots or underscores in them originally.
The only solution I can think of is replacing dots or spaces with non-
printable characters and then converting them back when I parse the
$_REQUEST array.

Can anyone shed light on why normal (and very useful) characters are
converted whereas others are left alone?

Re: PHP converts form field characters to underscores wrote:
Quoted text here. Click to load it

So, don't put the values in the "name" attribute.  Rather, give the
hidden field a legitimate name and put your values in the "value" attribute.

echo '<input type="hidden" name="field1" value="&#$i;">';

Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.

Site Timeline