MFB: Fix bug #36656 (http_build_query generates invalid URIs due to use of square brackets)

ext/standard/http.c

@@ -85,7 +85,7 @@ PHPAPI int php_url_encode_hash_ex(HashTable *ht, smart_str *formstr,
 		if (Z_TYPE_PP(zdata) == IS_ARRAY || Z_TYPE_PP(zdata) == IS_OBJECT) {
 			if (key_type == HASH_KEY_IS_STRING) {
 				ekey = php_url_encode(key.s, key_len, &ekey_len);
-				newprefix_len = key_suffix_len + ekey_len + key_prefix_len + 1;
+				newprefix_len = key_suffix_len + ekey_len + key_prefix_len + 3 /* %5B */;
 				newprefix = emalloc(newprefix_len + 1);
 				p = newprefix;
 
@@ -102,13 +102,14 @@ PHPAPI int php_url_encode_hash_ex(HashTable *ht, smart_str *formstr,
 					memcpy(p, key_suffix, key_suffix_len);
 					p += key_suffix_len;
 				}
-
-				*(p++) = '[';
+				*(p++) = '%';
+				*(p++) = '5';
+				*(p++) = 'B';
 				*p = '\0';
 			} else {
 				/* Is an integer key */
 				ekey_len = spprintf(&ekey, 12, "%ld", idx);
-				newprefix_len = key_prefix_len + num_prefix_len + ekey_len + key_suffix_len + 1;
+				newprefix_len = key_prefix_len + num_prefix_len + ekey_len + key_suffix_len + 3 /* %5B */;
 				newprefix = emalloc(newprefix_len + 1);
 				p = newprefix;
 
@@ -128,11 +129,13 @@ PHPAPI int php_url_encode_hash_ex(HashTable *ht, smart_str *formstr,
 					memcpy(p, key_suffix, key_suffix_len);
 					p += key_suffix_len;
 				}
-				*(p++) = '[';
+				*(p++) = '%';
+				*(p++) = '5';
+				*(p++) = 'B';
 				*p = '\0';
 			}
 			ht->nApplyCount++;
-			php_url_encode_hash_ex(HASH_OF(*zdata), formstr, NULL, 0, newprefix, newprefix_len, "]", 1, (Z_TYPE_PP(zdata) == IS_OBJECT ? *zdata : NULL), arg_sep TSRMLS_CC);
+			php_url_encode_hash_ex(HASH_OF(*zdata), formstr, NULL, 0, newprefix, newprefix_len, "%5D", 3, (Z_TYPE_PP(zdata) == IS_OBJECT ? *zdata : NULL), arg_sep TSRMLS_CC);
 			ht->nApplyCount--;
 			efree(newprefix);
 		} else if (Z_TYPE_PP(zdata) == IS_NULL || Z_TYPE_PP(zdata) == IS_RESOURCE) {