So I have a product listing page with each product displaying having an add to cart button.

This is done like so:

{exp:cartthrob:add_to_cart_form entry_id="{entry_id}"}
    <input type="submit" value="Add to basket">

All very well and good for a regular listing page. However this page also has a search feature, where search parameters are GET variables in the URL. Not having a return url strips the search so that is not the way forward.

So I decided to use the Mo' Variables {current_url} tag to push in the full URL. The problem I'm having now is when I have a search query like this:


The problem here is that when CartThrob comes back it gives the message Disallowed Key Characters. and the url is now:


Why is CartThrob adding a semi-colon before my colon?

Thanks in advance

Edit: I have already checked in the hidden fields in the add_to_cart_form and the return url is set properly:

<input type="hidden" name="return" value="/publications?keyword=media&amp;category:format=9">
  • Hey Joe, did you get anywhere with this issue? We're seeing exactly the same behaviour :-/ Jul 15, 2014 at 13:48
  • @AndrewArmitage I did actually, I'll answer my own question below this - plum forgot I had this up here!
    – Joe Beaver
    Jul 16, 2014 at 14:09

1 Answer 1


After a support call with CartThob I have this fixed. Turns out its actually a CodeIgniter issue (kinda). The request is basically passing through CI's XSS filter, which is picking this up as a possible XSS threat and escaping it.

The way I got around it was making a small addition to the system/expressionengine/third_party/cartthrob/libraries/Form_builder.php file.

Around line 714 you should see the code block

if ( ! $this->return)
    $this->return = ($this->EE->input->get_post('return')) ? $this->EE->input->get_post('return', TRUE) : $this->EE->uri->uri_string();

Which, with the addition, becomes

if ( ! $this->return)
    $this->return = ($this->EE->input->get_post('return')) ? $this->EE->input->get_post('return', TRUE) : $this->EE->uri->uri_string();
    $this->return = str_replace("category;:","category:",$this->return);

Obviously replacing "category" with whatever word(s) you are using.

Hope this sorts it for you too!

  • Thanks Joe, thats worked perfectly - much appreciated you taking the time to add an answer :-) Jul 17, 2014 at 20:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.