urldecode
urldecode($string)
Converts text encoded for a URL back: %XX sequences into the original bytes and the plus sign into a space. It is the opposite of urlencode().
Parameters
- $string – the encoded text.
Examples
echo urldecode("caf%C3%A9+%26+tea"); // café & tea
// plus is a space, rawurldecode leaves it
echo urldecode("a%20b+c"); // a b c
echo rawurldecode("a%20b+c"); // a b+c
// PHP decodes parameters from the URL itself (just like parse_str)
parse_str("q=C%2B%2B&page=2", $params);
echo $params["q"]; // C++
// decoding an already decoded value damages it
echo urldecode("jane+smith@example.com"); // jane smith@example.com
// text encoded twice – one call removes one level
echo urldecode("%2520"); // %20
// an invalid sequence stays unchanged
echo urldecode("discount 100%"); // discount 100%
echo urldecode("%zz"); // %zz
// the result does not have to be valid UTF-8 text
var_dump(mb_check_encoding(urldecode("%E9t%E9"), "UTF-8")); // bool(false)
Things to watch out for
- Do not call it on values from $_GET and $_REQUEST. PHP has already decoded them. A second decoding turns a plus into a space (the e-mail jane+smith@…, a password, the term C++) and a % sign followed by two digits into a different character.
- It is useful when processing a URL by hand, for example part of $_SERVER["REQUEST_URI"] or $_SERVER["QUERY_STRING"].
- Check the input only after decoding. Anything can arrive encoded: slashes and dots (../), the null byte and HTML tags.
- The result does not have to be valid UTF-8. Check it with mb_check_encoding() before further processing.
- An invalid sequence (a % sign without two hexadecimal digits) does not report an error and is left unchanged.
Related functions:
urlencode()
rawurldecode()
mb_check_encoding()