RE: [PHP] Problems URL Parameters

From: Date: Sat, 26 Apr 2003 15:42:32 +0000
Subject: RE: [PHP] Problems URL Parameters
References: 1  Groups: php.general 
Request: Send a blank email to php-general+get-145361@lists.php.net to get a copy of this message
> How can this SQL Script be interpreted/passed in PHP URL Parameters? > > SELECT * FROM bible > WHERE bibletitle = 'Ezra' AND > (chapter BETWEEN 002 AND 003) AND > (verse BETWEEN 013 AND 026); > > ...when I click a link it should retrieve the above info' > thru' a url parameter of this kind > ../bible.php?booktitle=ezra&chapter=002.....bla bla Any thing passed through the URL can be accessed through the $_GET array. Bible.php?booktitle=ezra&chapter1=002&chapter2=003&verse1=013&verse2=026 Then in bible.php: $query = "SELECT * FROM bible WHERE bibletitle = '{$_GET['booktitle']}' AND (chapter BETWEEN {$_GET['chapter1']} AND {$_GET['chapter2']}) AND (verse BETWEEN {$_GET['verse1']} AND {$_GET['verse2']}"; You'll need some validation to make sure the booktitle is properly escaped with addslashes() and that the other elements are just numbers, otherwise making a query like this is very insecure. ---John W. Holmes... PHP Architect - A monthly magazine for PHP Professionals. Get your copy today. http://www.phparch.com/

« previous php.general (#145361) next »