CODEWITHSUNDEEP
php
Iladarsda
Iladarsda

Reputation: 10692

Can I use $_POST & $_GET at the same time?

I have a following form:

<form action="doThis.php?warehouse=12" method="post">
  <input name="field1" type="text" />
  <input name="field2" type="text" />
</form>

And doThis.php:

$field1 = mysql_real_escape_string($_POST['field1'], $mysql);
$field2 = mysql_real_escape_string($_POST['field2'], $mysql);

$warehouse = $_GET['warehouse'];
if ( !someTableNameValidation($warehouse) ) {
    someErrorHandling();
}
$qry = "INSERT INTO table".$warehouse." ( field1, field2 ) VALUES( '$field2', '$field2') ";
$result = @mysql_query($qry, $mysql);

As you can see, I'm using $_POST to get data from the form, and $_GET to get variable $warehouse which is used to indicate table number.

Can I use both $_POST & $_GET at the same time? Is this kind of usage correct?

Upvotes: 3

Views: 4865

Answers (5)

matino
matino

Reputation: 17735

Yes you could. $_GET['warehouse'] will be taken from the query string, $_POST variables from submitted POST values.

Upvotes: 4

dynamic
dynamic

Reputation: 48141

Yes I always do that.

Also note you should never use mysql_query. Search for php PDO. Not to mention the awful @ for suppressing error

Upvotes: 1

Ashley
Ashley

Reputation: 1489

Yes, however it should be:

$field1 = $_POST['field1'];
$field2 = $_POST['field2'];

$warehouse = $_GET['warehouse'];

$qry = "INSERT INTO table".$warehouse." ( field1, field2 ) VALUES ('".mysql_real_escape_string($field2)."', '".mysql_real_escape_string($field2)."')";
$result = @mysql_query($qry);

(Fixed syntax)

Upvotes: 1

Julian
Julian

Reputation: 2061

I frequently use POST and GET together, so that the PHP side can know whether it was a normal form submission or via AJAX.

<form action='dest.php'>
.
.
.

vs

ajaxSubmit( 'dest.php?a=1', ... );

Upvotes: 0

Sascha Galley
Sascha Galley

Reputation: 16101

Yes, this is possible. But you could also use a hidden field:

<form action="doThis.php">
<input type="hidden" name="warehouse" value="12" />
<input name="field1" type="text" />
<input name="field2" type="text" />

Please be aware that your code is very vulnerable to sql injections!

Upvotes: 3

Related Questions