escape $_POST values (fixes #10)

[gitviola]

fixes #10

[lord]

Weird...I can't seem to replicate this bug. Do you think you could submit a short PHP file that contains the issue?

Thanks for contributing!

[gitviola]

Here is the code that I am using to perform a post request on the php file

angular.module('myApp')
  .factory('formsApi', function($http) {
    function create(form) {
      return $http({
        method:   'POST',
        url:      '/api/contact_form.php',
        transformRequest: function(obj) {
          var str = [];
          for(var p in obj)
            str.push(encodeURIComponent(p) + "=" + encodeURIComponent(obj[p]));
          return str.join("&");
        },
        data:     form,
        headers:  {'Content-Type': 'application/x-www-form-urlencoded', 'Accept': 'application/json'}
      }).then(function(formReponse) {
        return formReponse.data;
      });
    }

    return { create: create };
  });

Lets say that I type the following code into a textarea Hello, it's a beautiful day!

a part of the output in the console will look like this:

parse_str('_subject=Contact%20Request&message=Hello%2C%20it's%20a%20beautiful%20day!....', $_POST);

So it says something like this: parse_str('..content..'..still content....')

// After escaping the ' it works fine and I can work with the values in my php code.

---

So even there are other possible ways to get around this bug (I set 'Content-Type': 'application/x-www-form-urlencoded' and did not try it with setting it to 'Content-Type': 'application/json'), it is still good to fix it.

Also I did not have time to try it with get requests. Maybe that bug can occur there as well.

[lord]

Great, thanks for the contribution!