_REQUEST on Search Page

[andrew_f]

Hey, I am making a very modded Wiki site based on MediaWiki.

The script is this...

<Br><BR><div style="background-color:black; padding:10px;"><b>Not there?</b><br>Cool, we only ask so that the site is nice and clean.<Br>
<br> <a href=****/index.php?title='.$_REQUEST["search"].'&action=edit><b>Continue to add this shuffle</b></a></div>

This works fine for one worded searches, but if they search for one more thing - say "Neowin dot com" the address will render it as

search=Neowin+dot+com

- and when you click the link it'll only take the first word - so the page they make will only be called Neowin.

How can I fix this? It's kind of bugging me now :)

Cheers guys (and gals)

[nvme]

try using the urlencode() function

http://www.php.net/manual/en/function.urlencode.php

[TurboTuna]

also, you should never allow "unclean" code right off the bat like that, always sanitize it.

[Kudos Veteran]

also, you should never allow "unclean" code right off the bat like that, always sanitize it.

Yeah, it's an XSS attack waiting to happen.