Ampersands in PHP-populated drop-down list

[dennistmusic]

Hi,

I'm trying to create a new photo gallery for my web site that calls up the various galleries and photos in a dynamic ajax div, and also using a MySQL database with information on each gallery.

The user will select a gallery from a drop-down menu, the code for which I have below:


<form name="gal" action="" method="GET">
<div align="center">
<select name="gal" onchange="this.form.submit();">
<?php

// Include the MySQL class
$dbhost = 'XXXX';
$dbuser = 'XXXX';
$dbpass = 'XXXX';

$conn = mysql_connect($dbhost, $dbuser, $dbpass) or die ('Error connecting to mysql');

$dbname = 'database';
mysql_select_db($dbname);

$result = mysql_query("SELECT DISTINCT gallerynumber, galleryname FROM phototable");
if (!$result) {
exit ('Error performing query: ' . mysql_error());
}

while($row1 = mysql_fetch_array($result))
{
echo
"<option value='".$row1['gallerynumber']."&photo=1'>".$row1['galleryname']."</option>";
}

?>
</select>
</div>
</form>

Ideally, what I want is to pass the "gallerynumber" to the URL, which will ultimately look something like "/gallery.php?gal=1&photo=1". Everything comes out fine in the address bar until the ampersand, and then the "=". What ends up being passed is: "/gallery.php?gal=2%26photo%3D1".

I managed to make it work if I passed the variables through regular links:


while($row1 = mysql_fetch_array($result))
{
echo
"<a href='?gal=".$row1['gallerynumber']."&photo=1'>".$row1['galleryname']."</a>&nbsp;&nbsp;|&nbsp;&nbsp;";
}
but would prefer not to do so.

I'm new enough to be incredibly unfamiliar with escaping characters. Is there a simple way around this?

Thanks so much in advance!

[Jesdisciple]

Use &amp; instead of &, even if you're echoing an ordinary link. & is reserved in HTML for declaring special characters (including &amp;), and should only be used to do so.