CODEWITHSUNDEEP
phpheaderhttp-post
ragebunny
ragebunny

Reputation: 1760

Posting data using 'header(location: )' in php

i've just made a sign script for my website. The form posts the data to itself and then checks to see if all the data is correct. if so it then loads a payment page. To load this payment page i use:

  header(location: payment.php);

So i want to send data over to the page that im loading, i though i could use:

  $userid = mysql_insert_id();

to get the last id added to the database but its not working, maybe im using it wrong though. Anyway, i know what in my database the email address on every record with be unique as well as the id, so i thought maybe i'd change the header to:

 header(location: payment.php?email=$email);

This way it would put the email address into the URL and i'd be able to find the user again on the next page by using:

 $email = $_GET['email'];

Now this works fine and from that i can get the users details from the database. However i thought that putting someones email address into the URL wasn't best practice but i can't for the life of me think of another way around it.

Any suggestions or good ways of doing this?

Thanks for the time.

Upvotes: 1

Views: 4089

Answers (4)

Filip Roséen
Filip Roséen

Reputation: 63797

Use persistent data to be associated with client

Use $_SESSION to associate data with the current client, don't forget to call session_start (); before you actually append data to the array.

Note: This will require the use of cookies in the client

Include functionality into one file

Though if the only purpose of the page where the data is posted is to validate data, do that and then you could include ("payment.php");, no redirects required.

Or put the functionality of the form-landing page in payment.php instead.

Use a GET-parameter sent to payment.php

You could also redirect to payment.php?id=<val> where <val> is the id of the transaction, though you should not expose the real id since this will decrease security.

Unless you check to see so that a user can only access ids who actually belongs to them.

A hash of the payment info can be used instead since this value will not easily, or at all, be guessed.

Upvotes: 3

manny
manny

Reputation: 1948

Once you update your payment, create/ get your GUID or your unique id from your DB, and redirect to your success page with your guid or unique id, exposing this id will not harm anyway.

Upvotes: 0

Indranil
Indranil

Reputation: 2471

I think you should go back and check why mysql_insert_id() isn't working. That'll be the best way to get the data across.

Upvotes: 1

Criss
Criss

Reputation: 1211

Just start a session before doing anything in the two pages.

<?php session_start()

and on the verification page do something like

$_SESSION['email'] = $email;

and finally on the payment page you can get the email then via

$email = $_SESSION['email'];

Upvotes: 1

Related Questions