Is removing the "+" character the correct thing to do when echoing $_GET variables in PHP?

Question

I have a URL string similar to https://example.com/path/?welcome_screen=1&email_address=something else@example.com

In PHP, I call <?php echo $_GET['email_address']; ?>

This will produce something else@example.com

Specifically, the in the email address are replaced with spaces.

1. Is this expected?
2. If so, is there a way to prevent this from happening in the echo code above?
3. Or should it be processed when the email address is collected?

Answer 1

1. Yes, is a way of representing spaces in a URL. PHP automatically URL-decodes the value and converts it to spaces when creating the $_GET data because it assumes that's what the value in the original URL should represent.

2. No, it was too late by then.

3. Yes, you should URL encode before including the value in the URL so that is not treated as a special character. If PHP generates the URL, you can use the urlencode() function. Most other programming languages ​​have equivalent built-in functions.