Using special html entites like &, quote or double quote etc. as key for options of webform select component produces warning on submission says "an illegal choice has been detected please contact system administrator". I just dig into your code and solved that problem by patching your webform.module file by putting just one line of code at line 2293 as follows. see the bold line.

  if (is_array($elements['#value'])) {
          $value = $elements['#type'] == 'checkboxes' ? array_keys(array_filter($elements['#value'])) : $elements['#value'];
          foreach ($value as $v) {
<strong>            $v = html_entity_decode($v, ENT_QUOTES);
</strong>            if (!isset($options[$v])) {
              form_error($elements, t('An illegal choice has been detected. Please contact the site administrator.'));
              watchdog('form', 'Illegal choice %choice in !name element.', array('%choice' => $v, '!name' => empty($elements['#title']) ? $elements['#parents'][0] : $elements['#title']), WATCHDOG_ERROR);
            }
          }
        }
        elseif ($elements['#value'] !== '' && !isset($options[$elements['#value']])) {

since you recommend use of alphanumeric and _ as charactes for the key. but since todays huge demand of CRMs forces us to integerate webform to that. Since in CRM there is no key|lable pairs just a single a line for options that means there lable and keys are same. So we have to sync it and forces us to also use special charactes for keys in drupal. But there crap it does not work if we use special html entites as i wrote above. Anyway solution is above you have seen. Pls respond me if you have any view for that.

CommentFileSizeAuthor
#3 special-entities-1677880-3.patch491 bytesnicholasthompson

Comments

quicksketch’s picture

Thanks for the report. Checkboxes are notoriously difficult to work with in forms so I'm not too surprised that HTML entities cause a problem. I'll do some testing on this when I get a chance.

nicholasthompson’s picture

Version: 7.x-3.18 » 7.x-3.20
Status: Active » Needs work

This exists on 3.20 too.

However I think this fix only makes the error go away. For me, the checked items with & in them do not appear in the submission results.

nicholasthompson’s picture

Version: 7.x-3.20 » 7.x-3.x-dev
Status: Needs work » Needs review
StatusFileSize
new491 bytes

On examination, decoding the entities is entirely the wrong approach.

The issue lies further back down the chain where the return value is being check_plain'd. Removing this line fixes the issue.

I tested on my local instance with two extra rows on my select (checkboxes) using things like Quote"test|Quote Test Which produced:

<input type="checkbox" id="edit-submitted-test-35" name="submitted[test][Quote&quot;Test]" value="Quote&quot;Test" class="form-checkbox" />

I did tests with quotes, ampersands and square brackets. From all that I could see, outputted code is escaped by Drupal - so we're safe there. The check_plain simply seemed to confused things when comparing the response to the values defined on a select.

nicholasthompson’s picture

@quicksketch - is there anyway to trigger that patch to run against the 7.x-3.x automated testing setup on this project?

Ignore me - didn't know "Needs review" triggered a patch test :)

danchadwick’s picture

What is generated if you use something like:

"><script></script><bold>bold me</bold><"|Test
danchadwick’s picture

Status: Needs review » Closed (duplicate)
nicholasthompson’s picture

@DanChadwick - closed as duplicate of what?

danchadwick’s picture

See Referenced By issue above, below summary.