RE: [PHP] header("Location:") with POST-data

if security of the variables is the problem may want to consider the following flow: $variable='x=1&Y=2'; mcrypt_e $variable,key pass it in the URL (with encrypted data in the open) receive via the URL mcrypt_d $variable,key since the keys can be hard coded into the pages this would alow you to pass your variables in the URL without worrying about the user seeing it or not. see the mcrypt funvtion in the manual for actual usage params not sure about the overhead of this... careful if large/high traffic site Dave -----Original Message----- From: Michael Dearman [mailto:mdearman@inficad.com] Sent: Friday, December 15, 2000 9:39 AM To: mailing_list@gmx.at Cc: php-general@lists.php.net Subject: Re: [PHP] header("Location:") with POST-data mailing_list@gmx.at wrote: > > It is possible to do a redirect like: > header("Location: /script.php?X=1&Y=2\n"); > > but is this possible with POST and not GET-data, so the user wouldn't see > the Get-Variables in the URL??? > Would certainly like to hear any other solutions. And thanks Matthew, I've yet to use session variables, but maybe it's time to take a look. Here's our, probably naive, attempt at resolving this issue. 1. Use the ErrorDocument 404 /intercept.php trick in either the httpd.conf or .htaccess to force url's to non-existent files (such as book.html) to the processing script. Break off the extension and stick .php or whatever on the file name. Check if the file exists, process the file or 'include' an 'error_msg.inc'. 2. For encoded variables, use a regexp to check for intercept.php?. If so, capture the remainder of the url to attach to a desired file - using the header() So: in an .htaccess file or... if (...check for some standard means of using fake .html files or whatever) { check for existance of $file.inc, and include some file that makes sense } elseif (preg_match('/intercept\.php\?(.+)/', $REQUEST_URI, $arr)) { header("location: /action.php?$arr[1]"); } else { include "error_msg.html" } Any suggestions for improvement on this? Mike D. -- PHP General Mailing List (http://www.php.net/) To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net For additional commands, e-mail: php-general-help@lists.php.net To contact the list administrators, e-mail: php-list-admin@lists.php.net