Hi,

 

I'm working on a client area type thing...

 

I have a page which enables the user to search the database. I then have one of the search results displaying as a hyperlink.

 

The aim is for the hyperlink to link through to another page which displays more information.

 

To illustrate properly:

 

The search renders the results in a table showing Name, Date Joined, etc. I have got the name to display as a hyperlink through to another page. I'd like that next page to show further information from the table associated with that Name e.g. address, contact details etc.

 

However, I'm unsure as to how I pull the clicked name through to the next page to use to search the database for more information.

 

Can anyone help please?

 

I was thinking about setting a session variable?

You could pass the id parameter through the url. So when displaying the hyperlink, instead of domain.com/user it would be domain.com/user?uid=8473.

 

Then use $_GET['user'] to collect the id and search the table. Of course you would need to filter the query before. Eg. check that it is a number, not a word or code.

You could use a session variable, but I'm not sure how that would work after clicking on a hyperlink

You could pass the id parameter through the url. So when displaying the hyperlink, instead of domain.com/user it would be domain.com/user?uid=8473.

 

Then use $_GET['user'] to collect the id and search the table. Of course you would need to filter the query before. Eg. check that it is a number, not a word or code.

 

I have played with some session variables and I can't get it working. The thing is - the query will return more than one result, so I doubt a session variable will work. I need it to recognise what was clicked on.

 

So the whole url thing.....any chance you could shed some more light on that for me?

Ok - I have the variable coming through in the url. Just now to use it in a mysql_query?

as a rule i would steer clear of using $_SESSION unless you really need to... once you get past a 1 server set-up session scaling becomes interesting and less data per session makes it more interesting than stressful

Ok - I have the variable coming through in the url. Just now to use it in a mysql_query?

 

 

basicly yeah, you want to pass a numeric value as its quicker to work with

 

$user =  (int) $_GET['id'];

$query = mysql_query("SELECT username, email, joined FROM users WHERE userID = '$user'");

basicly yeah, you want to pass a numeric value as its quicker to work with

 

$user =  (int) $_GET['id'];

$query = mysql_query("SELECT username, email, joined FROM users WHERE userID = '$user'");

 

I will have to somehow assign a reference to each record then and use that value to pass through. As you say - it's easier to work with as at the moment I have the name going through which is like this "Name20%Surname"....

 

I'll have a go with the ID of the table.

 

So

$user = (int) $_GET['id'];

will pull it out of the url? That's it?

it depends what the variable is in the url

 

if the url is ?id=12, then $_GET['id'] is what you would use. If the url is ?user=34, then $_GET['user'] is what you would use

Crickey - it's working!!!!!

 

HAPPY HAPPY HAPPY

 

Many thanks - lifesaver. +1

cool cool glad it works...

 

reason ID is better is what happens if you have 2,6 or even 20 John Doe's... then your script would get confused as to which John Doe is needed :S

You may also wanna filter ur id to make sure it only can include numbers like this

 

$id = preg_replace('#[^0-9]#i','',$_GET['id']); 

theres no need to dig into regular expressions when you can cast type, like i did... try getting anything but an int in this variable..

 

$user = (int) $_GET['id'];

 

 

heres some code that demonstrates, the output is in the comment to the right of the var_dump

 

$safe_var = 1245;

$tainted_var = '<124';

$string_number = '12345';

echo var_dump((int) $safe_var); // int(1245) 

echo var_dump((int) $tainted_var); // int(0)

echo var_dump((int) $string_number); // int(12345) 

 

because its an id and will be a number, you can cast type the variable as a int... if it was a string like a name or somthing extra validation steps would be needed... hense why i recommended working with numbers... its just easier all-round really... if it was public facing then that wouldn't be the case for obvious SE ranking reasons

theres no need to dig into regular expressions when you can cast type, like i did... try getting anything but an int in this variable..

 

$user = (int) $_GET['id'];

 

 

heres some code that demonstrates, the output is in the comment to the right of the var_dump

 

$safe_var = 1245;

$tainted_var = '<124';

$string_number = '12345';

echo var_dump((int) $safe_var); // int(1245) 

echo var_dump((int) $tainted_var); // int(0)

echo var_dump((int) $string_number); // int(12345) 

 

because its an id and will be a number, you can cast type the variable as a int... if it was a string like a name or somthing extra validation steps would be needed... hense why i recommended working with numbers... its just easier all-round really... if it was public facing then that wouldn't be the case for obvious SE ranking reasons

 

Sorry i did not see that u had set it as a integer using (int)

no worries, just noticed the regular expression you've got the case-insensitive flag on, but the expression says anything not a number so you don't need the i in that instance