i need help, i'm trying to attach through civicrm_api3('Attach', 'create'..) a pdf file, passed with a rest call as simply text:

1 0 obj
<< /Type /Catalog
... ecc

. The attach works, but i thing that during it, the crm's file save function make an escape of some special chars... the results of content of pdf file is:

1 0 obj
&lt;&lt; /Type /Catalog
... ecc

there is a way to avoid this behavior?


  • I'm trying to find another solution to programmatically attach a file to custom field through API... but for now i haven't found it. Commented Jan 14, 2018 at 14:45

2 Answers 2


Sorry, this is a half-answer.

The HTML encoding is being added because this line is adding default 'wrapper' functions that include adding HTML entities (CRM_Utils_API_HTMLInputCoder).

You can fix this by altering the defaults passed into WrapperAdapter::construct(), to include 'content' in the array of skipFields. I think you could do this here.

Just add a line like

'content', // For attachment.create

This does work - I tried it.

However this may not be secure because I don't know if any of the other APIs use the rather generic 'content' parameter name. If they do, then removing the protection afforded could result in XSS vulnerabilities or other problems.

So the other way to fix it would be rename the API content something more unique attachment_content - but that would require changing a public API (!)

So another way would be to put in some sort of check that changes the default wrappers for the particular case of attachment.create, but I'm not familiar enough with the internal workings of the API system to suggest that patch.



thank you for answer me! i've resolved in this way:

  1. I've created file with pure PHP
  2. Then i've used civicrm_api3('Attach',...) with 'options.move-file'.

options.move-file is used to attach to civicrm_file record the previously created file.

Maybe isn't the best solution, but works!

Thank you!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.