{"action":"closed","issue":{"url":"https://api.github.com/repos/jonnnnyw/php-phantomjs/issues/29","labels_url":"https://api.github.com/repos/jonnnnyw/php-phantomjs/issues/29/labels{/name}","comments_url":"https://api.github.com/repos/jonnnnyw/php-phantomjs/issues/29/comments","events_url":"https://api.github.com/repos/jonnnnyw/php-phantomjs/issues/29/events","html_url":"https://github.com/jonnnnyw/php-phantomjs/issues/29","id":45464030,"number":29,"title":"Request data not encoded issue","user":{"login":"damonkreft","id":4972683,"avatar_url":"https://avatars.githubusercontent.com/u/4972683?v=3","gravatar_id":"","url":"https://api.github.com/users/damonkreft","html_url":"https://github.com/damonkreft","followers_url":"https://api.github.com/users/damonkreft/followers","following_url":"https://api.github.com/users/damonkreft/following{/other_user}","gists_url":"https://api.github.com/users/damonkreft/gists{/gist_id}","starred_url":"https://api.github.com/users/damonkreft/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/damonkreft/subscriptions","organizations_url":"https://api.github.com/users/damonkreft/orgs","repos_url":"https://api.github.com/users/damonkreft/repos","events_url":"https://api.github.com/users/damonkreft/events{/privacy}","received_events_url":"https://api.github.com/users/damonkreft/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2014-10-10T09:48:04Z","updated_at":"2015-02-17T14:43:58Z","closed_at":"2015-02-17T14:43:58Z","body":"`urldecode()` is used after `http_build_query()`'ing the request data, producing unsafe non-encoded data with a high risk of malformed JS. The request data contains \\ (backslash), ' (apostrophe), new line chars etc, the request breaks...\r\n\r\n```javascript\r\npage.open ('http://localhost:8889/charts', 'POST', 'testRequest=This breaks using this apostrophe ' plus this new line char \r\n also, there should be a backslash in front of \this', function (status) {\r\n     ...\r\n});\r\n```\r\n\r\nRemoving `urldecode()` produces...\r\n\r\n```javascript\r\npage.open ('http://localhost:8889/charts', 'POST', 'testRequest=This+breaks+using+this+apostrophe+%27+plus+this+new+line+char+%0A+also%2C+there+should+be+a+backslash+in+front+of+%09his', function (status) {\r\n    ...\r\n});\r\n```\r\n\r\nwhich seemingly decodes fine on the server side.\r\n\r\nPull request https://github.com/jonnnnyw/php-phantomjs/pull/28"}}