Posted on by borobhaisab

raw_urlencode() Questions

Hello,

You use raw_urlencode() on the file path. Does that mean you have to exclude the domain name part ?

<?php
echo '<a href="http://example.com/'.
    rawurlencode('Sales and Marketing').
    '/search?'.
    'query='.urlencode('Monthly Report').
    '">Click Me</a>';
?>

Imagine the above is my link listed on one of my pages.
Now, why is it necessary for me to raw_urlencode() my own site's file path when I put the above link on my pages ? How could xss attack be done here ?
Or is raw_urlencode() really not necessary here unless I get echoing user submitted links ?
Eg. My page getting the url from my mysql db via $_GET[].