Use form input to build url with php.

Question

I'm trying to create a form where the user can input their id (username) and it will be appended as a variable in a url that is used in my php script. This is what I have.

<?php
if(isset($_POST['submit']))
{
    $id = $_POST['id'];
    echo 'http://example.com/default.asp?action=data&id=$id';
}
?>
<form method="post" action="<? echo $_SERVER['PHP_SELF']; ?>">
   <input type="text" name="id"><br>
   <input type="submit" name="submit" value="Submit Form"><br>
</form>

It collects the user's id properly, and if i just echo $id, it outputs the proper value, but when I try to echo the url, it just outputs $id instead of the actual value of the $id variable. What am I doing wrong?

Why not use GET method and add hidden fields for other parameters? — Josh
– Josh, Commented Apr 16, 2012 at 22:00
use double quotes for the echo. or using single quotes and concatenate $id to the url string. — thescientist
– thescientist, Commented Apr 16, 2012 at 22:01
You should really lookup cross site scripting or XSS on google, currently you have 2 avenues of attack within 10 lines of code...smell — Lawrence Cherone
– Lawrence Cherone, Commented Apr 16, 2012 at 22:04

Marc B · Accepted Answer · 2012-04-16 22:00:51Z

4

echo "http://example.com/default.asp?action=data&id=$id";
     ^---wrong quotes                                  ^--- ditto

single-quoted strings do not interpolate variables.

answered Apr 16, 2012 at 22:00

Marc B

362k44 gold badges433 silver badges508 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

citruspi · Accepted Answer · 2012-04-16 22:02:57Z

1

Single quotes won't interpolate the variable, either use double quotes or use string concatenation.... Three options:

    echo "http://example.com/default.asp?action=data&id=".$id;

or

    echo "http://example.com/default.asp?action=data&id=$id";

or

    echo 'http://example.com/default.asp?action=data&id='.$id;

answered Apr 16, 2012 at 22:02

citruspi

6,8994 gold badges29 silver badges43 bronze badges

1 Comment

citruspi Over a year ago

fixed... sorry, I was typing fast :(

Caleb Taylor · Accepted Answer · 2012-04-16 22:03:42Z

1

This line:

echo 'http://example.com/default.asp?action=data&id=$id';

Should be

echo 'http://example.com/default.asp?action=data&id='.$id;

If you are using single quotes in PHP with a string it will print whatever is inside the string without evaluating anything (ie no variables are evaluated). So you can either use double quotes or append the variable like I did above.

answered Apr 16, 2012 at 22:03

Caleb Taylor

1779 bronze badges

Collectives™ on Stack Overflow

Use form input to build url with php.

3 Answers 3

Comments

1 Comment

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Related