CODEWITHSUNDEEP
php
user20929302
user20929302

Reputation: 403

PHP $_GET removing a variable from URL string

I am trying to create my form to $_GET for bookmarks later down the road. Currently whenever I have tried to $_GET my value, it always sends me to the page I made default on load. One thing I have tried was using a hidden value Using this line of code (Commented it out in my example below of where I tried it):

<input type='hidden' value='<?=$topic?>'/>

I have a web url:

https://mywebpage.com/testphp.php?topic=home.php

The reason for the topic=home.php is that I am going to be switching pages all from the testphp.php page and each will have their own seperate form. If the webpage is loaded with topic=null or topic = "", then it will default to home.php.

When I am creating a HTML Form (Pretty Basic for now) on home.php, omitted everything except the form:

<form id = "test" method = "GET">
    <!--<input type='hidden' value='<?=$topic?>'/>-->
    <input type="text" name="firstname" Value = '<?=$fname?>' onchange="rememberField(this)">&nbsp;
    <input type="Submit" name="Search" >
</form>

Using $_GET for "firstname" on my subpage.php

<?php
    include 'index.php';
    $fname = "";
    $reqmethod = $_SERVER["REQUEST_METHOD"];
    if($reqmethod == "GET") {
        $fname = $_GET["firstname"];
    }
?>

Gathers the "firstname" as it should, and use it to input into the SQL that I create, but the thing it doesn't do is maintain the firstname=ben part.

Instead the new web url looks like this, which will default to home.php:

https://mywebpage.com/testphp.php?firstname=ben

The expected result that I want is:

https://mywebpage.com/testphp.php?topic=home.php&firstname=ben

Upvotes: 0

Views: 58

Answers (2)

user2575725
user2575725

Reputation:

You missed the name attribute:

<input type='hidden' value='<?=$topic?>' name='topic'/>

P.S. this approach of including server side scripts are venerable to security attacks, so beware!

Just take and example if someone manages to inject this topic=http://hacker.com/erase-all-pages.php

Upvotes: 3

Jorge Bowen
Jorge Bowen

Reputation: 182

In your hidden field you must set a name for the input

<input type='hidden' value='<?=$topic?>'/> <!--BAD INPUT-->

<input type='hidden' name="topic" value='<?=$topic?>'/>  <!-- WITH NAME ATTRIBUTE -->

Upvotes: 0

Related Questions