Mangled Data

Solution, forwarded to PHP list:
================================

OK, solved this.

The form input MUST be contained in SINGLE quotes; probably to avoid
being manipulated by the PHP parser.  Double quotes or no quotes don't
work.

Example:

<input type="hidden" name="trans" id="trans" value='<?php echo 
$data ?>'>

where $data is the incoming JSON data string.

Thanks for your assistance.

Regards,

John
============


-------- Forwarded Message --------
From: Glash Gnome <[email protected]>
To: [email protected]
Subject: Re: Mangled Data
Date: Mon, 18 Oct 2021 02:58:16 +0200

> I'm not sure,
> 
> <input type="hidden" name="trans1" id="trans1" value= <?php echo $data
> ?> >
> 
> @see : https://stackoverflow.com/a/31220637/15142111
> 
> Le dim. 17 oct. 2021 à 23:42, John <[email protected]> a écrit :
> > Thanks for your prompt response.
> > 
> > It isn't quite that obvious because the internal JSON is already an
> > array, but I think the following will accomplish what you need.  I
> > have annotated the code and result.
> > 
> > This has to be run in two steps because the data that gets mangled
> > is being passed through to another script.  It doesn't change in
> > this script except to be copied to the form.  All of the validations
> > (see below) show that the incoming data is valid.
> > 
> > First, here is the entire script that I used for the script #1
> > test.  I numbered the lines so I could refer to them in the output.
> > 
> > -----
> > // test starts here
> > 1. echo("<br /> start of var_dump<br /> <br /><hr><br />");
> > 2. var_dump($_POST['trans']);
> > 3. echo "<br /> <br />Start decode record array<br />";
> > 4. $line =
> > json_decode($_POST['trans'],true,512,JSON_INVALID_UTF8_IGNORE);
> > 5. var_dump(json_decode($line[0],true));
> > 6. $item = json_decode($line[0],true,512,JSON_INVALID_UTF8_IGNORE);
> > 7. var_dump(json_decode($item[0],true));
> > 8. echo "<br /> <br /><hr><br/>Decode item<br />";
> > 9. echo "<br />i_qty: " . $item['i_qty'] . "<br />";
> > 10. echo "i_name: " . $item['i_name'] . "<br /> <hr><br />";
> > 
> > 11. echo("<br /><br /><hr><br />Start of echo of actual data
> > received<br />");
> > 12. $data = $_POST['trans'];
> > 13. echo "<br />" . $data . "<br /> <br /><hr><br />";
> > // test ends here
> > 
> > -----
> > Start with the incoming transaction JSON from the previous script:
> > 
> > line 1 demonstrates that there is incoming JSON data and that it can
> > be dumped.  Here is the output of the var_dump command:
> > 
> > -------
> > string(248) "["{\"i_code\":20,\"i_qty\":1,\"i_name\":\"Canadian
> > Amateur Radio Basic Qualification Study
> > Guide\",\"i_price\":\"44.95\"}","{\"i_code\":18,\"i_qty\":1,\"i_name
> > \":\"Canadian Amateur Radio Advanced Qualification Study
> > Guide\",\"i_price\":\"44.95\"}"]" 
> >  -------
> > 
> > Now I take the first line of the incoming array and json_decode it
> > to get the associative array in lines 4 and 5:
> > 
> > Start decode record array
> > ---------
> > array(4) { ["i_code"]=> int(20) ["i_qty"]=> int(1) ["i_name"]=>
> > string(54) "Canadian Amateur Radio Basic Qualification Study Guide"
> > ["i_price"]=> string(5) "44.95" } NULL 
> > -------
> > 
> > Now display the associative array in lines 6 - 10 giving:
> > 
> > -----------
> > Decode item
> > 
> > i_qty: 1
> > i_name: Canadian Amateur Radio Basic Qualification Study Guide
> > ----------- 
> > 
> > So, at this point, all works as expected.  Just for completeness,
> > here is the un-decoded JSON string that is being passed in (lines 11
> > - 13):
> > 
> > ------------
> > Start of echo of actual data received
> > 
> > ["{\"i_code\":20,\"i_qty\":1,\"i_name\":\"Canadian Amateur Radio
> > Basic Qualification Study
> > Guide\",\"i_price\":\"44.95\"}","{\"i_code\":18,\"i_qty\":1,\"i_name
> > \":\"Canadian Amateur Radio Advanced Qualification Study
> > Guide\",\"i_price\":\"44.95\"}"]
> > ------------
> > 
> > The incoming data is passed without modification to the form (second
> > line from end of form):
> > 
> > ------------
> > <form method="POST" name="order" id="order" onSubmit="finished()"
> > action="./ord0003.t.php">
> > <input type="hidden" name="addr" id="addr" value="">
> > <input type="hidden" name="trans1" id="trans1" value= <?php echo
> > $data ?> >
> > </form>
> > ------------
> > 
> > Now I invoke the submit method of the form.  The result is displayed
> > in the following script, although I used JavaScript to show that the
> > data in the form is wrong already.
> > 
> > --------------
> > 1. if (isset($_POST['trans1']))
> > 2. {
> > 3.  $ord_jdata = $_POST['trans1'];
> > 4.  echo "<br/><hr><br /> <br />" . $ord_jdata . "<br /> <hr> <br
> > />";
> > 5.
> >  var_dump(json_decode($ord_jdata),true,512,JSON_INVALID_UTF8_IGNORE)
> > ;
> > 6.  echo "<br /> <br /><hr><br /> <br />";
> > 
> > 7.  exit;
> > --------------
> > 
> > The result is the mangled data that I don't understand why, and is
> > the same as what I saw in the previous script when I displayed
> > submission using JavaScript:
> > 
> > First, get the data as a string in lines 3 and 4 because it isn't
> > valid JSON so won't decode.
> > ------------
> > ["{\"i_code\":20,\"i_qty\":1,\"i_name\":\"Canadian
> > ------------
> > 
> > Note that the string is terminated at the first X20 " " character. 
> > Now, here is the attempted decode of the incoming data from line 5:
> > 
> > --------------------
> > NULL bool(true) int(512) int(1048576) 
> > --------------------
> > 
> > The salient point, so far as I can see, is that the only string
> > variable is being chopped into separate blocks at each word break,
> > ie each X20 " " character and treated as separate null parameters. 
> > If I try to retrieve the data with these words as data names I get:
> > 
> > --------------
> > NULL NULL NULL NULL 
> > --------------
> > 
> > So I broke something here because previously they showed up as
> > separate variables but since the problem is already displayed I
> > dropped the debugging there.
> > 
> > Please let me know if there is anything else that might show what's
> > wrong here.
> > 
> > Regards, 
> > 
> > John
> > =====================
> > 
> > On Sat, 2021-10-16 at 05:43 +0200, Glash Gnome wrote:
> > > Hello,
> > > 
> > > Can you modify this example to show the issue ?
> > > <?php
> > > //var_dump($_POST);
> > > if (isset($_POST['data'])) {
> > >     var_dump($_POST['prop']);
> > >     var_dump(json_decode($_POST['prop-a']));
> > >     var_dump(json_decode($_POST['prop-b']));
> > > }
> > > ?><html>
> > >     <form method="post">
> > >         <input name="prop[]" value="This" />
> > >         <input name="prop[]" value="Is" />
> > >         <input name="prop[]" value='"Array"' />
> > > 
> > >         <input name="prop-a" value="Hello" id="element" />
> > > 
> > >         <textarea name="prop-b" rows="4" cols="50"
> > > > {
> > >     "a": "str='hello'",
> > >     "b": 2
> > > }</textarea>
> > >         <input name="data" value='"Submit !"' type="submit"/>
> > >     </form>
> > >     <script type="text/javascript">
> > >         let playlist = {
> > >             'DADJU & ANITTA' : "let's go \"mon soleil\"",
> > >         };
> > >         var elt = document.getElementById('element');
> > >         elt.value = JSON.stringify(playlist);
> > >     </script>
> > > </html>
> > > Regards,
> > > 
> > > Le sam. 16 oct. 2021 à 01:55, John <[email protected]> a
> > > écrit :
> > > > PHP 7.2.9
> > > > 
> > > > An incoming JSON string is not acted on in this script; just
> > > > passed
> > > > through to the next script. I do the following, where 'trans' is
> > > > a
> > > > JSON string:  (ie result of JavaScript stringify() command) 
> > > > 
> > > > if (isset($_POST['trans']))
> > > > {
> > > >  $ord_jdata = $_POST['trans'];
> > > > 
> > > > ....
> > > > 
> > > > <form method="POST" name="order" id="order"
> > > > onSubmit="finished()"
> > > > action="....>
> > > > <input type="hidden" name="trans-1" id="trans-1" value= <?php
> > > > echo
> > > > $ord_jdata ?> >
> > > > </form>
> > > > 
> > > > When this is submitted the data stored in form.trans-1 is NOT
> > > > the same
> > > > as the data in $ord.jdata, specifically the following component,
> > > > as
> > > > shown by the Firefox devtools | inspector command no longer has
> > > > the
> > > > escape \ before the " character. 
> > > > 
> > > > The JSON data contains a string (part of an array) that, when
> > > > received
> > > > is:
> > > > ... ,\"name\":'"some data is found here\", ... 
> > > > but this is stored in the form input field as:
> > > > ... ,\"some" data="" is="" found="" here=\",
> > > > 
> > > > which is not at all the same thing.  Apparently the spaces
> > > > within the
> > > > string are being treated as delimiters for null parameters.  
> > > > 
> > > > Experimenting, I can do a valid/correct json_decode on the
> > > > incoming
> > > > data; it just doesn't copy properly.
> > > > 
> > > > After reading the JSON part of the PHP manual I can't see why
> > > > this
> > > > should be so and I suspect that I have run over some constarint
> > > > on
> > > > data formatting but I don't see it.
> > > > 
> > > > Can anyone help??
> > > > 
> > > > Thanks in advance.
> > > > 
> > > > John
> > > > ============
> > 
> >