CODEWITHSUNDEEP
javascriptphpget
SolidSolutions
SolidSolutions

Reputation: 3

GET parameter not passing through

I'm having a weird error while trying to pass GET variables. On the product page I have multiple sizes for the same product, each size has its own form with two variables, product ID (product_id) and quantity (qty), that are sent to another page (add.php) to be added to the cart.

My problem is that qty is passed no problem but product_id does not go through, I used Burp suite to check the data sent between the server and the client and when I click on the submit button the product_id does not get attached to the URL (as we can see below)

GET /newsite/add.php?qty=1 HTTP/1.1

here is the code that I use

$selectQuery = "SELECT * FROM products WHERE product_master_id = $masterID ORDER BY length(product_quantity_description), product_quantity_description";
$selectResult = mysql_query($selectQuery);
$i = 0;
while($selectRow = mysql_fetch_array($selectResult)) {
    echo '<form action="add.php?product_id='.$selectRow['product_id'].'&qty=<script>document.getElementById(\'qty'.$i.'\').value</script>" class="form form-inline clearfix">
    <span class="tag" id="desc">'.$selectRow['product_name'].'</span>                                   
    <span class="tag" id="qtyDesc">$'.$selectRow['product_quantity_description'].'</span>
    <span class="tag" id="oldPrice">$'.number_format ($selectRow['old_price'], 2).'</span>
    <span class="tag" id="averagePrice">$'.number_format ($selectRow['average_price'], 2).'</span>
    <span class="tag" id="price">$'.number_format ($selectRow['product_price'], 2).'</span>
    &nbsp;
    <div class="numbered">
        <input type="text" name="qty" id="qty'.$i.'" value="1" class="tiny-size" />
        <span class="clickable add-one icon-plus-sign-alt"></span>
        <span class="clickable remove-one icon-minus-sign-alt"></span>
    </div>';
    if($selectRow['Special'] == 1 && $selectRow['product_oos'] == 0)
        echo '<span class="stock">
            <span class="btn btn-warning" id="stock">Ask for availability</span>
            </span>';
    if($selectRow['product_oos'] == 1)
        echo '<span class="btn btn-danger pull-right">Out of Stock</span>';
    else
        echo '<button class="btn btn-success pull-right">Add &nbsp; <i class="icon-shopping-cart"></i></button>';
    echo '</form>';
    $i++;
}

this is what we can see by looking at the source code of the loaded page

<form action="add.php?product_id=559&amp;qty=&lt;script&gt;document.getElementById('qty0').value&lt;/script&gt;" class="form form-inline clearfix">

I didn't understand why qty gets appended to the URL but not product_id.

Upvotes: 0

Views: 118

Answers (1)

Syed Daniyal Asif
Syed Daniyal Asif

Reputation: 736

In this situation you have to passed variables in hidden fields. Do not make simple things complex. 

<input type="hidden" name="product_id" value="$selectRow['product_id']" />
<input type="hidden" name="qty" value="document.getElementById(\'qty'.$i.'\').value" />

and make 

<input type="text" name="qty"  id="qty'.$i.'" value="1" class="tiny-size" />

to 

<input type="text"  id="qty'.$i.'" value="1" class="tiny-size" />

now your code looks like.

$selectQuery = "SELECT * FROM products WHERE product_master_id = $masterID ORDER BY     length(product_quantity_description), product_quantity_description";
$selectResult = mysql_query($selectQuery);
$i = 0;
while($selectRow = mysql_fetch_array($selectResult)) {
echo '<form action="add.php" class="form form-inline clearfix">
<span class="tag" id="desc">'.$selectRow['product_name'].'</span>                                   
<span class="tag" id="qtyDesc">$'.$selectRow['product_quantity_description'].'</span>
<span class="tag" id="oldPrice">$'.number_format ($selectRow['old_price'], 2).'</span>
<span class="tag" id="averagePrice">$'.number_format ($selectRow['average_price'], 2).'</span>
<span class="tag" id="price">$'.number_format ($selectRow['product_price'], 2).'</span>
&nbsp;
<div class="numbered">
<input type="hidden" name="product_id" value="$selectRow['product_id']" />
<input type="hidden" name="qty" value="document.getElementById(\'qty'.$i.'\').value" />       
<input type="text"  id="qty'.$i.'" value="1" class="tiny-size" />
    <span class="clickable add-one icon-plus-sign-alt"></span>
    <span class="clickable remove-one icon-minus-sign-alt"></span>
</div>';
if($selectRow['Special'] == 1 && $selectRow['product_oos'] == 0)
    echo '<span class="stock">
        <span class="btn btn-warning" id="stock">Ask for availability</span>
        </span>';
if($selectRow['product_oos'] == 1)
    echo '<span class="btn btn-danger pull-right">Out of Stock</span>';
else
    echo '<button class="btn btn-success pull-right">Add &nbsp; <i class="icon-shopping-cart"></i></button>';
echo '</form>';
$i++;

}

Upvotes: 2

Related Questions