$_POST Value Geting Plus Signs Removed

Question

We are passing a ssh public key via an API call, using POST. The strange thing is, when we get the value in PHP, the plus (+) signs are completely stripped. Clearly, this does not work, as it changes the value of the public key.

See the following raw curl request:

curl "https://api.example.com/v1/keys" -X POST -d "key=ssh-dss AAAAB3NzaC1kc3MAAACBAOLsyYuyI0/3/UjajY8ljdgkAV2k9jZxjlVGWvHa9afMuO7DqsOcu0o4e5D9TPScsO5XrgTrmcXHkOtM54fOPdXSzonWOXUIn1XEumdHDlv9YRZTCW/A9qajhPR67y+92su9AqeGXI0/q3BXZsZcC1nr1NjgSiz++r+YZFVWfQsNAAAAFQCYBf0KXVLfYUE6cOTbWnBWn5Py9QAAAIEA3WAkAwhR7fhwWpxuwxNnsB8NXwsEs2NWiOaiMu3dmDWyqGRjfOYUchoLelBMpv4oLTZuaGW4/DCWfdh6pgrxs39MXf+FdTir8KeHIIoXEdcXpWqnuyNBdXn5XNY54vc1eMkbm4q3D1i3+IMhNAURasdvFRoDzgH9s68Ik3P5HrMAAACAab+CiT010wXMzv+6v+oWcRWbxhGou/ND+K2QGU1kAW+KuUGmhOgB6XPka7iEsIeA/+Ojh+OiNedFZlJAZq1jarew106YCOrUlbtDk7pAAUJQhIhKFhpNE0UhLRBWOF9LpjDwWu55dlrfLURE32TuMx/NsazWVypbzJqy48d2sg8= justin@mbpro"

But, when we var_dump() out the value of $_POST['key'] in our PHP it is:

string(601) "ssh-dss AAAAB3NzaC1kc3MAAACBAOLsyYuyI0/3/UjajY8ljdgkAV2k9jZxjlVGWvHa9afMuO7DqsOcu0o4e5D9TPScsO5XrgTrmcXHkOtM54fOPdXSzonWOXUIn1XEumdHDlv9YRZTCW/A9qajhPR67y 92su9AqeGXI0/q3BXZsZcC1nr1NjgSiz  r YZFVWfQsNAAAAFQCYBf0KXVLfYUE6cOTbWnBWn5Py9QAAAIEA3WAkAwhR7fhwWpxuwxNnsB8NXwsEs2NWiOaiMu3dmDWyqGRjfOYUchoLelBMpv4oLTZuaGW4/DCWfdh6pgrxs39MXf FdTir8KeHIIoXEdcXpWqnuyNBdXn5XNY54vc1eMkbm4q3D1i3 IMhNAURasdvFRoDzgH9s68Ik3P5HrMAAACAab CiT010wXMzv 6v oWcRWbxhGou/ND K2QGU1kAW KuUGmhOgB6XPka7iEsIeA/ Ojh OiNedFZlJAZq1jarew106YCOrUlbtDk7pAAUJQhIhKFhpNE0UhLRBWOF9LpjDwWu55dlrfLURE32TuMx/NsazWVypbzJqy48d2sg8= justin@mbpro"

Any idea what is causing the plus signs to be removed?

Answer 1

+ plus characters in form data are interpreted as space characters by some servers.

You can avoid this by encoding the plus characters in the form data as %2B. Instead of using -d/--data, use cURL's --data-urlencode parameter to do this.

PHP's rawurlencode function could perform the same encoding if you were constructing an outgoing request. However, when incoming response data is accessed by your PHP script on the server, it has already been automatically decoded, so you don't need to (and shouldn't) call rawurldecode yourself.