{"id":52687,"date":"2021-07-12T03:01:30","date_gmt":"2021-07-11T17:01:30","guid":{"rendered":"http:\/\/www.rjmprogramming.com.au\/ITblog\/?p=52687"},"modified":"2021-07-11T14:00:47","modified_gmt":"2021-07-11T04:00:47","slug":"javascript-and-php-multiple-encoding-and-decoding-tutorial","status":"publish","type":"post","link":"https:\/\/www.rjmprogramming.com.au\/ITblog\/javascript-and-php-multiple-encoding-and-decoding-tutorial\/","title":{"rendered":"Javascript and PHP Multiple Encoding and Decoding Tutorial"},"content":{"rendered":"
\"Javascript<\/a>

Javascript and PHP Multiple Encoding and Decoding Tutorial<\/p><\/div>\n

Around here, we are very fond of dropdown (select element) “multiple” (attribute) selection mode. That is a mode whereby you can select multiple options (helped out by using ctrl and command keyboard keys). Unfortunately, order matters quite often, as with today’s exploits, and thoughts of the use of the “multiple” attribute often fly out the window, unless you can know ahead of time that the order you statically construct your dropdown’s options is always a good enough order for your purposes.<\/p>\n

So why not for today’s work? Well, all the encoding and decoding options are totally “peers” in our thinking, and the user, if thinking of a “multiple” (ie. multi-layered) encoding\/decoding job, will not want to be dictated by the order we present the encoding and decoding options in our dropdown of yesterday, when we presented Javascript and PHP Encoding and Decoding Primer Tutorial<\/a>.<\/p>\n

As an example, a user might want to see the end result of …<\/p>\n


\n[... To] = btoa(encodeURIComponent(base64_encode([From ...])));
\n<\/code><\/p>\n

… say. Well, that is not in an order corresponding to the dropdown’s order. So we should not resort to a “multiple” attribute mode dropdown mode of use. What is the alternative? Here, it is best to set up event logic for that dropdown’s “onchange” event, ours looking like (fleshed out from yesterday)<\/font> … <\/p>\n

<?php echo ”
\n
\n function consider(sio) {
\n if (sio.value.trim() != '') {
\n if (document.getElementById('topoption').innerHTML.indexOf(');') !=-1) {
\n document.getElementById('topoption').innerHTML=document.getElementById('topoption').innerHTML.replace(' = ', ' = ' + sio.value + '(').replace(');', '));');
\n ajaxit();
\n if (document.getElementById('sende').innerHTML == '') {
\n document.getElementById('sende').innerHTML='<input style=background-color:orange; onclick=\\\"multi=true;\\\" id=xende name=complex value=\\\"' + document.getElementById('topoption').innerHTML + '\\\" type=submit><\/input>';
\n document.getElementById('sviaextra').innerHTML='<input style=background-color:orange; onclick=\\\"multi=true; document.getElementById(' + \\\"'\\\" + 'xende' + \\\"'\\\" + ').click();\\\" title=\\\"Do all the options individually clicked\\\" style=display:inline-block; id=zende value=\\\"+\\\" type=button><\/input>';
\n } else {
\n document.getElementById('xende').value=document.getElementById('topoption').innerHTML;
\n }
\n } else {
\n document.getElementById('topoption').innerHTML='[... To] = ' + sio.value + '([From ...]);';
\n ajaxit();
\n }
\n }<\/font>
\n }
\n<\/code>
\n“; ?><\/p>\n

Notice the Javascript function name “ajaxit”? Yes, in “[… To] = btoa(encodeURIComponent(base64_encode([From …])));”<\/font> we have a “[… To] = btoa_Javascript<\/i>(encodeURIComponent_Javascript<\/i>(base64_encode_PHP<\/i>([From …])));”<\/font> mix of PHP and Javascript based encoding\/decoding calls required. How best to flow, staying on the same webpage, without a complexity of form navigations (away from the current webpage)? Use the good ol’ “midair feeling” Ajax<\/a>\/FormData<\/a> techniques, as per …<\/p>\n

<?php echo ”
\n
\n var multi=false;
\n var interim='';
\n var xhr=null;
\n var newform=null;
\n
\n function showStuff(evt) {
\n if (xhr != null) {
\n if (xhr.readyState == 4) {
\n if (xhr.status == 200) {
\n interim=xhr.responseText;
\n }
\n }
\n }
\n }
\n
\n function ajaxit() {
\n var dto='';
\n if (document.getElementById('tvia').value.indexOf('btoa') == 0 && interim == '') {
\n dto=btoa(document.getElementById('tfrom').value);
\n } else if (document.getElementById('tvia').value.indexOf('atob') == 0 && interim == '') {
\n try {
\n dto=atob(document.getElementById('tfrom').value);
\n } catch(ecvd) { dto=' '; alert('You have some invalid characters for atob to handle.'); }
\n } else if (document.getElementById('tvia').value.toUpperCase().indexOf('encodeURIComponent'.toUpperCase()) == 0 && interim == '') {
\n dto=encodeURIComponent(document.getElementById('tfrom').value);
\n } else if (document.getElementById('tvia').value.toUpperCase().indexOf('decodeURIComponent'.toUpperCase()) == 0 && interim == '') {
\n dto=decodeURIComponent(document.getElementById('tfrom').value);
\n } else if (document.getElementById('tvia').value.toUpperCase().indexOf('encodeURI'.toUpperCase()) == 0 && interim == '') {
\n dto=encodeURI(document.getElementById('tfrom').value);
\n } else if (document.getElementById('tvia').value.toUpperCase().indexOf('decodeURI'.toUpperCase()) == 0 && interim == '') {
\n dto=decodeURI(document.getElementById('tfrom').value);
\n } else if (document.getElementById('tvia').value.indexOf('btoa') == 0 && interim != '') {
\n dto=btoa(interim);
\n } else if (document.getElementById('tvia').value.indexOf('atob') == 0 && interim != '') {
\n try {
\n dto=atob(interim);
\n } catch(ecvd) { dto=' '; alert('You have some invalid characters for atob to handle.'); }
\n } else if (document.getElementById('tvia').value.toUpperCase().indexOf('encodeURIComponent'.toUpperCase()) == 0 && interim != '') {
\n dto=encodeURIComponent(interim);
\n } else if (document.getElementById('tvia').value.toUpperCase().indexOf('decodeURIComponent'.toUpperCase()) == 0 && interim != '') {
\n dto=decodeURIComponent(interim);
\n } else if (document.getElementById('tvia').value.toUpperCase().indexOf('encodeURI'.toUpperCase()) == 0 && interim != '') {
\n dto=encodeURI(interim);
\n } else if (document.getElementById('tvia').value.toUpperCase().indexOf('decodeURI'.toUpperCase()) == 0 && interim != '') {
\n dto=decodeURI(interim);
\n }
\n if (dto != '') {
\n if (dto == ' ') {
\n document.getElementById('topoption').innerHTML=document.getElementById('topoption').innerHTML.replace('atob(', '(');
\n } else {
\n interim=dto;
\n }
\n } else {
\n xhr=new XMLHttpRequest();
\n newform=new FormData();
\n if (interim != '') {
\n newform.append('from', interim);
\n } else {
\n newform.append('from', document.getElementById('tfrom').value);
\n }
\n newform.append('via', document.getElementById('tvia').value);
\n newform.append('ajax', 'y');
\n xhr.open('post', '.\/encoding_decoding.php', true);
\n xhr.onreadystatechange = showStuff;
\n xhr.send(newform);
\n }
\n }
\n<\/code>
\n“; ?><\/p>\n

Again, you could (re-)try the changed PHP<\/a> “proof of concept” web application<\/a> code to see and try this for yourself.<\/p>\n

\n

\n

Previous relevant Javascript and PHP Encoding and Decoding Primer Tutorial<\/a> is shown below.<\/p>\n

\"Javascript<\/a>

Javascript and PHP Encoding and Decoding Primer Tutorial<\/p><\/div>\n

The recent HTML form navigation work gobsmacked us mildly as we reconnected with the fact that a character like “~” is not changed (ie. encoded) by Javascript’s “encodeURIComponent” encoding function. And then we figured that “~” can get you back to home directories on Linux and Unix, so presumably, could appear in a URL non-argument part (ie. the address of your web script). There are others too, and so we decided to write a practical way for you to experiment with.<\/p>\n

Let’s show you the PHP “proof of concept” web application<\/a> code, it being pretty short, below …<\/p>\n


\n<?php
\n\/\/ encoding_decoding.php
\n\/\/ User experimentation with encoding and decoding systems
\n\/\/ RJM Programming
\n\/\/ July, 2021
\n$pfrom=\"The quick brown fox jumps over the lazy dog and tilde (~) followed closely behind, dragging along 0 Mostel!?\";
\n$pto=\"\";
\n$pvia=\"\";
\n$blurb=\"Please choose an encode or decode option below ...\";
\nif (isset($_POST['from']) && isset($_POST['via'])) {
\n $pfrom=str_replace('+',' ',urldecode($_POST['from']));
\n $pvia=str_replace('+',' ',urldecode($_POST['via']));
\n if (strpos(urldecode($_POST['via']), \"base64_encode\") !== false) {
\n $pto=base64_encode($pfrom);
\n $blurb=$pvia;
\n } else if (strpos(urldecode($_POST['via']), \"base64_decode\") !== false) {
\n $pto=base64_decode($pfrom);
\n $blurb=$pvia;
\n } else if (strpos(urldecode($_POST['via']), \"urlencode\") !== false) {
\n $pto=urlencode($pfrom);
\n $blurb=$pvia;
\n } else if (strpos(urldecode($_POST['via']), \"urldecode\") !== false) {
\n $pto=urldecode($pfrom);
\n $blurb=$pvia;
\n }
\n}
\n
\necho \"
\n<html>
\n<head>
\n<script type='text\/javascript'>
\n function consider(sio) {
\n }
\n
\u200b
\n function maybeclient() {
\nocument.getElementById('tvia').value=document.getElementById('tvia').value.toLowerCase().replace('uri','URI').replace('component','Component');
\n if (document.getElementById('tvia').value == '') {
\n return false;
\n } else if (document.getElementById('tvia').value.indexOf('base64') == 0) {
\n return true;
\n } else if (document.getElementById('tvia').value.indexOf('url') == 0) {
\n return true;
\n } else if (document.getElementById('tvia').value.indexOf('atob') == 0) {
\n try {
\n document.getElementById('tto').value=atob(document.getElementById('tfrom').value);
\n } catch(ecvd) { alert('You have some invalid characters for atob to handle.'); }
\n } else if (document.getElementById('tvia').value.indexOf('btoa') == 0) {
\n document.getElementById('tto').value=btoa(document.getElementById('tfrom').value);
\n } else if (document.getElementById('tvia').value.toUpperCase().indexOf('encodeURIComponent'.toUpperCase()) == 0) {
\n document.getElementById('tto').value=encodeURIComponent(document.getElementById('tfrom').value);
\n } else if (document.getElementById('tvia').value.toUpperCase().indexOf('decodeURIComponent'.toUpperCase()) == 0) {
\n document.getElementById('tto').value=decodeURIComponent(document.getElementById('tfrom').value);
\n } else if (document.getElementById('tvia').value.toUpperCase().indexOf('encodeURI'.toUpperCase()) == 0) {
\n document.getElementById('tto').value=encodeURI(document.getElementById('tfrom').value);
\n } else if (document.getElementById('tvia').value.toUpperCase().indexOf('decodeURI'.toUpperCase()) == 0) {
\n document.getElementById('tto').value=decodeURI(document.getElementById('tfrom').value);
\n }
\n return false;
\n }
\n<\/script>
\n<\/head>
\n<body>
\n<h1>User experimentation with encoding and decoding systems<\/h1>
\n<h3>RJM Programming - July, 2021<\/h3>
\n<form onsubmit='return maybeclient();' method=POST action=.\/encoding_decoding.php>
\n<table style=width:90%; border=60>
\n<tr><th>From ... <\/th><th> ... <input type=submit value=via><\/input> ... <\/th><th> ... To<\/th><\/tr>
\n<tr><td><textarea rows=30 style=width:100%; name=from id=tfrom>\" . $pfrom . \"<\/textarea><\/td><td style=vertical-align:top;text-align:center;><select size=11 name=via id=tvia onchange=consider(this);>
\n<option value='\" . strtoupper($pvia) . \"'>\" . $blurb . \"<\/option>
\n<option value='base64_encode'>base64_encode<\/a><\/option>
\n<option value='base64_decode'>base64_decode<\/a><\/option>
\n<option value='btoa'>btoa<\/a><\/option>
\n<option value='atob'>atob<\/a><\/option>
\n<option value='urlencode'>urlencode<\/a><\/option>
\n<option value='urldecode'>urldecode<\/a><\/option>
\n<option value='encodeURIComponent'>encodeURIComponent<\/a><\/option>
\n<option value='decodeURIComponent'>decodeURIComponent<\/a><\/option>
\n<option value='encodeURI'>encodeURI<\/a><\/option>
\n<option value='decodeURI'>decodeURI<\/a><\/option>
\n<\/select><\/td><td><textarea readonly rows=30 style=width:100%; name=to id=tto>\" . $pto . \"<\/textarea><\/td><\/tr>
\n<tr><td colspan=3><input id=ende value='Encode or Decode' type=submit><\/input><\/td><\/tr>
\n<\/table>
\n<\/body>
\n<\/html>\";
\n
\n?>
\n<\/code><\/p>\n

The space character is one to watch. A client side HTML and Javascript form “encodeURIComponent”s any space to %20 but serverside PHP “urlencode”s a space to the “+” character. This “+” is a legitimate character in data-URIs and we find we need to assume a “urldecode” of passed in characters, if they do not contain …<\/p>\n