how to get array from unrealized data

Question

my code-

$order[$j][1]=$q16;
<input type="hidden" name="hdnOrder" value="<?php echo htmlentities(serialize($order)); ?>">

on my next page-

$order =  array_map('mysql_real_escape_string', unserialize($_REQUEST['hdnOrder']));

it gives me the following error- Warning: array_map() [function.array-map]: Argument #2 should be an array

I want order value in array form because of-

foreach($order as $row)

Perhaps not exactly your question, but why not store that hdnOrder in a session or database and then fetch it after the form? The way you have it the user can tamper with it and then submit an erroneous hdnOrder — Fanis Hatzidakis
– Fanis Hatzidakis, Commented Nov 21, 2010 at 12:19

Pekka · Accepted Answer · 2010-11-21 12:33:41Z

1

Your problem is the htmlentities() you are doing on the data.

Use htmlspecialchars(serialize($order), ENT_QUOTES) instead and do a htmlspecialchars_decode() afterwards.

$order =  array_map('mysql_real_escape_string', 
 unserialize(htmlspecialchars_decode($_REQUEST['hdnOrder'], ENT_QUOTES)));

answered Nov 21, 2010 at 12:33

Pekka

451k150 gold badges989 silver badges1.1k bronze badges

Sign up to request clarification or add additional context in comments.

Comments

c0rnh0li0 · Accepted Answer · 2010-11-21 13:32:02Z

0

You should use urldecode/urlencode instead of htmlentities.

answered Nov 21, 2010 at 13:32

c0rnh0li0

1491 silver badge8 bronze badges