CODEWITHSUNDEEP
php
Exploit
Exploit

Reputation: 6386

how to count the values inside HTTP_SERVER_VARS['QUERY_STRING']

I have defined a var to be used in my forms and it grabs all the parameters automatically so that i dont have to check for them. problem is how do i count the values inside HTTP_SERVER_VARS['QUERY_STRING'] ?

when i do var_dump i see string(0) "" when I have no params but when i do it beings string(#) where # is the num of params. I have tried count() but it shows a value of 1 no matter how many params i put.

this is what i have set up.

define('PHP_SELF', htmlentities($_SERVER['PHP_SELF']) . "?". $HTTP_SERVER_VARS['QUERY_STRING']);

this is how i use it.

<form method="POST" action="<?= PHP_SELF ?>">
....
</form>

my problem is even if there are no params the action looks like /page.php? and I want to check against the params so if no params are set then i can take out the ? mark. How would i do this?

let me know you understand what im trying to say.

Upvotes: 0

Views: 383

Answers (2)

Lekensteyn
Lekensteyn

Reputation: 66405

The query string is the part in a URL after and including the questionmark (e.g. ?x=1 in http://www.example.com/dir/file.php?x=1). You should use the $_GET array instead of parsing $_SERVER['QUERY_STRING'] variable manually. For POST fields, use $_POST.

If you want to hide the query string part if it's empty, why not do so?

define(PHP_SELF,
    htmlentities($_SERVER['PHP_SELF'] .
        ($_SERVER['QUERY_STRING'] ? '?' . $_SERVER['QUERY_STRING'] : '')
    ));

Note that I've moved the closing parenthese of htmlentities to protect against XSS from the query string.

Upvotes: 3

Aurelio De Rosa
Aurelio De Rosa

Reputation: 22152

You can use this:

if ($_SERVER['QUERY_STRING'] !== '')
   $count = count(explode('&', $_SERVER['QUERY_STRING']));
else
   $count = 0;

or maybe you can do this (more simple):

$count = count($_GET);

Upvotes: 1

Related Questions