bugzy Posted July 28, 2012 Share Posted July 28, 2012 I have a form get like this <form action="<?php echo $_SERVER['REQUEST_URI']."&"; ?>" method="get" name="search"> that form is for example on www.mywebsite.com/search.php?cat=1001 if I click submit button, I'm expecting this www.mywebsite.com/search.php?cat=1001&search=textbox_anything But it is always redirecting me to www.mywebsite.com/search.php?search=textbox_anything It is removing the cat=1001 Is there any alternative? Link to comment https://forums.phpfreaks.com/topic/266367-_get-and-request_uri-complict/ Share on other sites More sharing options...
requinix Posted July 28, 2012 Share Posted July 28, 2012 If you set method=get then the query string in the action URL will be overwritten with whatever the form data is. It looks like all you're expecting is the category ID? Put that in a hidden field. </pre> <form action="search.php" method="get" name="search"> " />< Link to comment https://forums.phpfreaks.com/topic/266367-_get-and-request_uri-complict/#findComment-1364992 Share on other sites More sharing options...
bugzy Posted July 28, 2012 Author Share Posted July 28, 2012 Perfect! Thanks! requinix Link to comment https://forums.phpfreaks.com/topic/266367-_get-and-request_uri-complict/#findComment-1364998 Share on other sites More sharing options...
requinix Posted July 28, 2012 Share Posted July 28, 2012 Uh, I posted something potentially very bad. Try again: </pre> <form action="search.php" method="get" name="search"> " />< XSS Link to comment https://forums.phpfreaks.com/topic/266367-_get-and-request_uri-complict/#findComment-1364999 Share on other sites More sharing options...
bugzy Posted July 28, 2012 Author Share Posted July 28, 2012 Uh, I posted something potentially very bad. Try again: <form action="search.php" method="get" name="search"> <input type="hidden" name="cat" value="<?php echo (int)$_GET["cat"]; ?>" /> XSS Just a question, so (int) is necessary to increase security on every numeric data that will be pass on the url? are htmlentities and urlencode also suitable for this? Link to comment https://forums.phpfreaks.com/topic/266367-_get-and-request_uri-complict/#findComment-1365000 Share on other sites More sharing options...
scootstah Posted July 28, 2012 Share Posted July 28, 2012 urlencode() isn't meant to prevent XSS, so no. You could use htmlentities() if you wanted, but if it is going to be numeric it's easier to just typecast it. There's no point having sanitized data if it isn't valid data. Link to comment https://forums.phpfreaks.com/topic/266367-_get-and-request_uri-complict/#findComment-1365003 Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.