? string_api.patch
Index: core/string_api.php
===================================================================
RCS file: /cvsroot/mantisbt/mantisbt/core/string_api.php,v
retrieving revision 1.89
diff -u -r1.89 string_api.php
--- core/string_api.php	6 Jul 2007 21:15:17 -0000	1.89
+++ core/string_api.php	9 Jul 2007 15:23:05 -0000
@@ -196,6 +196,22 @@
 		return $p_string;
 	}
 
+	# this function is called from string sanitize_url
+	# it returns the full query string with trailing "?"
+	function string_sanitize_url_helper( $p_array, $p_prefix = "" ) {
+		$t_string = "";
+		foreach($p_array as $k => $v) {
+			( !empty( $p_prefix ) ) ? $t_prefix = $p_prefix . "[$k]" : $t_prefix = $k;
+			( empty( $p_prefix ) && empty( $t_string ) ) ? $t_prefix = '?' . $t_prefix : $t_prefix = '&' . $t_prefix;
+			if( is_array( $v ) ) {
+				$t_string .= string_sanitize_url_helper( $v, $t_prefix );
+			} else {
+				$t_string .= $t_prefix . "=" . urlencode( strip_tags( urldecode( $v ) ) );
+			}
+		}
+		return $t_string;
+	}
+
 	# --------------------
 	# validate the url as part of this site before continuing
 	function string_sanitize_url( $p_url ) {
@@ -218,14 +234,8 @@
 			if ( $t_param !== "" ) {
 				$t_vals = array();
 				parse_str( $t_param, $t_vals );
-				$t_param = '';
-				foreach($t_vals as $k => $v) {
-					if ($t_param != '') {
-						$t_param .= '&'; 
-					}
-					$t_param .= "$k=" . urlencode( strip_tags( urldecode( $v ) ) );
-				}
-				return $t_path . '?' . $t_param;
+				$t_param = string_sanitize_url_helper( $t_vals );
+				return $t_path . $t_param;
 			} else {
 				return $t_path;
 			}