title: escape urldecode unescape confusion
body: <p>I've got a TinyMCE editor - the contents of which need to be uploaded by AJAX.</p>
  
  <p>Obviously because of the AJAX sending the parameters, they need to be escaped via javascripts escape() function, this is so it doesn't break the AJAX parameters. The fields are <code>mysql_real_escape_string</code>'ed at the PHP side, I only need the escape for the AJAX parameters.</p>
  
  <p>Unfortunately, when I add links and images into the editor and then submit, the URLs to the images and links appear like this: </p>
  
  <pre><code>http://localhost:8888/%22../img/miscimages/hwo-american.gif/%22
  </code></pre>
  
  <p>On the page where the contents are displayed to the user (the product view page), the string from the database is run through <code>urldecode()</code> to get rid of all the <code>%22</code> and other escaped characters. There is no javascript on this page, it's all generated with PHP, hence the <code>urldecode()</code> and not <code>unescape()</code>. Is there any way around this?</p>
  
  <p><strong>CODE:</strong></p>
  
  <p>AJAX Send</p>
  
  <pre><code>function update(){
      if (window.XMLHttpRequest)
      {// code for IE7+, Firefox, Chrome, Opera, Safari
          xmlhttp=new XMLHttpRequest();
      }else{// code for IE6, IE5
          xmlhttp=new ActiveXObject("Microsoft.XMLHTTP");
      }
  
      xmlhttp.onreadystatechange=function()
      {
          if (xmlhttp.readyState==4 &amp;&amp; xmlhttp.status==200)
          {
              var response = xmlhttp.responseText;
              alert(response);
              window.location = 'admin-products.php';
          }
      }
      var prodID=document.getElementById("editchoice").value;
      var edittitle=escape(document.getElementById("editname").value);
      var editcategory=document.getElementById("editcat").value;
      var editcontent = escape(tinyMCE.get('editcontent').getContent());
      var parameters= "prodID="+prodID+"&amp;title="+edittitle+"&amp;content="+editcontent+"&amp;cat="+editcategory;
      xmlhttp.open("POST", "../scr/editProduct.php", true);
      xmlhttp.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
      xmlhttp.send(parameters);
  }
  </code></pre>
  
  <p>PHP Database Insert</p>
  
  <pre><code>$prodID = $_POST['prodID'];
  $title = urldecode(mysql_escape_string($_POST['title']));
  $content = urldecode(mysql_escape_string($_POST['content']));
  $category = $_POST['cat'];
  
  echo $prodID . $title . $content . $category;
  
  mysql_query("UPDATE product SET title='$title', content='$content', category_id='$category' WHERE id='$prodID'") or die("ERROR: ".mysql_error());
  </code></pre>
  
  <p>PHP Display on Page</p>
  
  <pre><code>/* Get Product from Alias */
  $alias = $_GET['name'];
  $product_selectProd = mysql_query("SELECT * FROM product WHERE alias='$alias'") or die("ERROR: ". mysql_error());
  
  /* Sort Query Vars */
  while($product_arrayProd = mysql_fetch_array($product_selectProd)){
      $product_category = $product_arrayProd['category_id'];
      $product_title = urldecode($product_arrayProd['title']);
      $product_text = urldecode($product_arrayProd['content']);
      $product_image = $product_arrayProd['main_image'];
      $product_sub_image = $product_arrayProd['sub_image'];
  
      /* Build the Product List */
      $productDetail .= "&lt;img src='$product_image' width='350' height='240' class='prod_image_left' /&gt;&lt;img src='$category_image' width='350' height='240' class='prod_image_right' /&gt;";
      $productDetail .= "&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;h1&gt;Fiddes $product_title&lt;/h1&gt;&lt;hr /&gt;";
      $productDetail .= "$product_text";
  }
  </code></pre>