Ampersands in database

Question

I am trying to write a php function that goes to my database and pulls a list of URLS and arranges them into an xml structure and creates an xml file.

Problem is, Some of these urls will contain an ampersand that ARE HTML encoded. So, the database is good, but currently, when my function tries to grab these URLS, the script will stop at the ampersands and not finish.

One example link from database:

http://www.mysite.com/myfile.php?select=on&league_id=8&sport=15

function buildXML($con) {
//build xml file
$sql = "SELECT * FROM url_links";
$res = mysql_query($sql,$con);

$gameArray = array ();

while ($row = mysql_fetch_array($res))
    {
    array_push($row['form_link']);
    }

$xml = '<?xml version="1.0" encoding="utf-8"?><channel>';

foreach ($gameArray as $link)
    {   
        $xml .= "<item><link>".$link."</link></item>";  
    }

$xml .= '</channel>';   
file_put_contents('../xml/full_rankings.xml',$xml);
}

mysql_close($con);
session_write_close();

If i need to alter the links in the database, that can be done.

Answer 1

You can use PHP's html_entity_decode() on the $link to convert & back to &.

In your XML, you could also wrap the link in <![CDATA[]]> to allow it to contain the characters.

$xml .= "<item><link><![CDATA[" . html_entity_decode($link) . "]]></link></item>"; 

UPDATE
Just noticed you're actually not putting anything into the $gameArray:

array_push($row['form_link']);

Try:

$gameArray[] = $row['form_link'];

* @Musa looks to have noticed it first, for due credit.

Answer 2

Look at this line

array_push($row['form_link']);

you never put anything in the $gameArray array, it should be

array_push($gameArray, $row['form_link']);

Answer 3

You need to use htmlspecialchars_decode. It will decode any encoded special characters in string passed to it.

Answer 4

This is most likely what you are looking for:

http://www.php.net/manual/en/function.mysql-real-escape-string.php

Read the documentation, there are examples at the bottom of the page...

'&' in oracleSQL and MySQL are used in queries as a logical operator which is why it is tossing an error.

You may also want to decode the HTML...