php - UTF-8 all the way through

itemprop="text">

I'm setting up a
new server and want to support UTF-8 fully in my web application. I have tried this in
the past on existing servers and always seem to end up having to fall back to
ISO-8859-1.

Where exactly do I need to set the
encoding/charsets? I'm aware that I need to configure Apache, MySQL, and PHP to do this
— is there some standard checklist I can follow, or perhaps troubleshoot where the
mismatches occur?

This is for a new Linux
server, running MySQL 5, PHP, 5 and Apache 2.

class="post-text" itemprop="text">

class="normal">Answer

Data
Storage:

• Specify
  the utf8mb4 character set on all tables and text columns in
  your database. This makes MySQL physically store and retrieve values encoded natively in
  UTF-8. Note that MySQL will implicitly use utf8mb4 encoding if
  a utf8mb4_* collation is specified (without any explicit
  character set).




• In older versions of
  MySQL (< 5.5.3), you'll unfortunately be forced to use simply
  utf8, which only supports a subset of Unicode characters. I
  wish I were
  kidding.

Data
Access:

• In
  your application code (e.g. PHP), in whatever DB access method you use, you'll need to
  set the connection charset to utf8mb4. This way, MySQL does no
  conversion from its native UTF-8 when it hands data off to your application and vice
  versa.




• Some drivers provide their own
  mechanism for configuring the connection character set, which both updates its own
  internal state and informs MySQL of the encoding to be used on the connection—this is
  usually the preferred approach. In
  PHP:

  
  
  
  
  
  

  • If
    you're using the rel="noreferrer">PDO abstraction layer with PHP ≥ 5.3.6, you can specify
    charset in the href="http://php.net/manual/en/ref.pdo-mysql.connection.php"
    rel="noreferrer">DSN:

    
    
    

    $dbh
                = new
                PDO('mysql:charset=utf8mb4');
    

  
  

  • If
    you're using rel="noreferrer">mysqli, you can call href="http://php.net/manual/en/mysqli.set-charset.php"
    rel="noreferrer">set_charset():

    
    
    

    $mysqli->set_charset('utf8mb4');
                // object oriented style
    mysqli_set_charset($link, 'utf8mb4'); // procedural
                style
    

  
  
  

  • If
    you're stuck with plain rel="noreferrer">mysql but happen to be running PHP ≥ 5.2.3, you can call
    rel="noreferrer">mysql_set_charset.

  
  



• If
  the driver does not provide its own mechanism for setting the connection character set,
  you may have to issue a query to tell MySQL how your application expects data on the
  connection to be encoded: href="http://dev.mysql.com/doc/en/charset-connection.html"
  rel="noreferrer">SET NAMES
'utf8mb4'.




• The
  same consideration regarding
  utf8mb4/utf8 applies as
  above.

Output:

• If
  your application transmits text to other systems, they will also need to be informed of
  the character encoding. With web applications, the browser must be informed of the
  encoding in which data is sent (through HTTP response headers or href="https://stackoverflow.com/q/4696499">HTML
  metadata).





• In
  PHP, you can use the href="http://www.php.net/manual/en/ini.core.php#ini.default-charset"
  rel="noreferrer">default_charset php.ini option,
  or manually issue the Content-Type MIME header yourself, which
  is just more work but has the same
  effect.




• When encoding the output using
  json_encode(), add
  JSON_UNESCAPED_UNICODE as a second
  parameter.

Input:

• Unfortunately,
  you should verify every received string as being valid UTF-8 before you try to store it
  or use it anywhere. PHP's href="http://php.net/manual/en/function.mb-check-encoding.php"
  rel="noreferrer">mb_check_encoding() does the
  trick, but you have to use it religiously. There's really no way around this, as
  malicious clients can submit data in whatever encoding they want, and I haven't found a
  trick to get PHP to do this for you
  reliably.




• From my reading of the
  current HTML spec, the
  following sub-bullets are not necessary or even valid anymore for modern HTML. My
  understanding is that browsers will work with and submit data in the character set
  specified for the document. However, if you're targeting older versions of HTML (XHTML,
  HTML4, etc.), these points may still be
  useful:

  
  
  
  
  
  
  • For
    HTML before HTML5 only: you want all data sent to you by browsers to be in
    UTF-8. Unfortunately, if you go by the the only way to reliably do this is add the
    accept-charset attribute to all your
    
    tags: accept-charset="UTF-8">.
  
  
  • For
    HTML before HTML5 only: note that the W3C HTML spec says that clients
    "should" default to sending forms back to the server in whatever charset the server
    served, but this is apparently only a recommendation, hence the need for being explicit
    on every single
    tag.
  
  

Other
Code
Considerations:

• Obviously
  enough, all files you'll be serving (PHP, HTML, JavaScript, etc.) should be encoded in
  valid UTF-8.





• You need to
  make sure that every time you process a UTF-8 string, you do so safely. This is,
  unfortunately, the hard part. You'll probably want to make extensive use of PHP's href="http://www.php.net/manual/en/book.mbstring.php"
  rel="noreferrer">mbstring
  extension.




• PHP's
  built-in string operations are not by default UTF-8
  safe. There are some things you can safely do with normal PHP string
  operations (like concatenation), but for most things you should use the equivalent
  mbstring
  function.




• To know what you're doing
  (read: not mess it up), you really need to know UTF-8 and how it works on the lowest
  possible level. Check out any of the links from rel="noreferrer">utf8.com for some good resources to learn everything you
  need to know.