RE: [PHP] Problems URL Parameters
| From: | John W. Holmes | Date: | Sat, 26 Apr 2003 15:42:32 +0000 |
| Subject: | RE: [PHP] Problems URL Parameters | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-145361@lists.php.net to get a copy of this message | ||
> How can this SQL Script be interpreted/passed in PHP URL Parameters?
>
> SELECT * FROM bible
> WHERE bibletitle = 'Ezra' AND
> (chapter BETWEEN 002 AND 003) AND
> (verse BETWEEN 013 AND 026);
>
> ...when I click a link it should retrieve the above info'
> thru' a url parameter of this kind
> ../bible.php?booktitle=ezra&chapter=002.....bla bla
Any thing passed through the URL can be accessed through the $_GET
array.
Bible.php?booktitle=ezra&chapter1=002&chapter2=003&verse1=013&verse2=026
Then in bible.php:
$query = "SELECT * FROM bible WHERE bibletitle = '{$_GET['booktitle']}'
AND (chapter BETWEEN {$_GET['chapter1']} AND {$_GET['chapter2']}) AND
(verse BETWEEN {$_GET['verse1']} AND {$_GET['verse2']}";
You'll need some validation to make sure the booktitle is properly
escaped with addslashes() and that the other elements are just numbers,
otherwise making a query like this is very insecure.
---John W. Holmes...
PHP Architect - A monthly magazine for PHP Professionals. Get your copy
today. http://www.phparch.com/