CODEWITHSUNDEEP
php
blerta
blerta

Reputation: 129

Issue getting variable from link

I have this code which permits me to pass a variable to another page, but the problem is i cannot seem to get that variable using the link. We have tried before, this same method and has worked.. could you please check it?

Thanks..

The link:

$sql="SELECT * FROM pianificazione";
$query = mysql_query($sql);
while ($row = mysql_fetch_array($query)) {
?>
<a href="lista_attivita.php?&id=<?php echo $row['job_id'] ; ?>"><?php echo $row['job'] ?></a>
<?php echo '</br><br />'; }
?>

The page after the link:

include('menu.php');
$id=$_GET['job_id'];
$sql="SELECT * FROM attivita WHERE job_id='$id'";
$query = mysql_query($sql);
while ($row = mysql_fetch_array($query)) {
?>
<a href="lista_attivita.php?&id=<?php echo $row['att_id'] ?>"><?php echo $row['attivita_da_promuovere'] ?>-<?php echo $row['attivita_tip_merc'] ?>-<?php echo $row['attivita_da_svolgere'] ?>-<?php echo $row['attivita_tip_personale'] ?></a>

Upvotes: 0

Views: 106

Answers (4)

a coder
a coder

Reputation: 7639

Two things.

1) FUNCTIONALITY

$id=$_GET['job_id'];

should be 

$id=$_GET['id'];

since your link passes the variable id, not job_id: 

lista_attivita.php?&**id**=<?php echo $row['job_id']

2) SECURITY

Never, NEVER insert user-input data directly into a SQL query. You are asking for headaches or worse. The $id on your receiving page should be validated and escaped prior to doing any lookup. If you expect a number, do something like this on the receiving page: 

if (!is_numeric($_GET['id']))
{
// throw error
}

It's not a bad idea to query your DB for valid codes, put those in an array, then check that array to see if the passed value is found. This prevents user entered data from reaching your DB.

Something like this: 

$q = "SELECT DISTINCT(id) FROM my_table WHERE display=1 ORDER BY id ASC";
$res = mysqli_query($dbx,$q);
while (list($_id) = mysqli_fetch_array)
{
  $arr_valid_id[] = $_id;
}

Then, 

if (in_array($_GET[id],$arr_valid_id[])
{
// do stuff
} else {
// throw error
}

Upvotes: 0

sbeliv01
sbeliv01

Reputation: 11820

In the URL that you're passing to the "page after link" you're setting "?id=xxx" as the parameter however in your script, your looking for "job_id".

Change the parameter to ?job_id= in your first script.

Upvotes: 0

andrewsi
andrewsi

Reputation: 10732

You're passing it as:

lista_attivita.php?&id=<?php echo $row['job_id'] ; ?>

And then looking for it as:

$id=$_GET['job_id'];

You should use:

$id=$_GET['id'];

Upvotes: 1

user399666
user399666

Reputation: 19879

You should be using:

$id = $_GET['id'];

You're also open to SQL injections... Either parse it as an INT:

$id = (int) $_GET['id'];

... or use prepared statements with PDO (instead of the default mysql functions that you're using, which are no longer recommended).

Upvotes: 3

Related Questions