Hi,
is there any reason why the data is urlencoded when submitted with POST?
tbl_change.php#222:
<form method="post" action="tbl_replace.php" name="insertForm" <?php if ($is_upload) { echo ' enctype="multipart/form-data"'; } ?>> <?php echo PMA_generate_common_hidden_inputs($db, $table); ?> <input type="hidden" name="goto" value="<?php echo urlencode($goto); ?>" /> <input type="hidden" name="pos" value="<?php echo isset($pos) ? $pos : 0; ?>" /> <input type="hidden" name="session_max_rows" value="<?php echo isset($session_max_rows) ? $session_max_rows : ''; ?>" /> <input type="hidden" name="disp_direction" value="<?php echo isset($disp_direction) ? $disp_direction : ''; ?>" /> <input type="hidden" name="repeat_cells" value="<?php echo isset($repeat_cells) ? $repeat_cells : ''; ?>" /> <input type="hidden" name="dontlimitchars" value="<?php echo (isset($dontlimitchars) ? $dontlimitchars : 0); ?>" /> <input type="hidden" name="err_url" value="<?php echo urlencode($err_url); ?>" /> <input type="hidden" name="sql_query" value="<?php echo isset($sql_query) ? urlencode($sql_query) : ''; ?>" />
this is very confusing, as GET submitted data gets automatically decoded but not POST submitted data - and forcing an urldecode on not encoded data could affect the sql query content