User input string passed through a url

Question

I am building a travel website where people can build up their travel itineraries.

There are pre built itineraries with cities and the users can click a button "Add to Itinerary" and this adds to the databse - this work fine.

I also want the opportunity for the user to add their own cities. The way I want to do this is by them clicking a button similar to "Add to Itinerary" but then they enter the name of this city and add to the list that way.

This is the code I have for the "Add to Itinerary" which is working.

<?php
if ( $_SESSION['user'] != "" ) {
  if ( in_array("Bangkok", $aray) ) { ?>
    <button class="buttonAddedItinerary">Already Added </button>
  <?php
  } else {
    ?>
    <a href="process.php?action=addtoItinirary&UCty=Bangkok">
      <button class="buttonAddItinerary">Add to Itinerary</button>
    </a>
  <?php
  }
}
?>

So basically I want when I click the button:
<a href="process.php?action=addtoItinirary&UCty=USERINPUT"...

I will not answer with a workaround as every php beginners guide could help you ... One thing that I could suggest to you is: never trust what user input into your fields ;) — DonCallisto
– DonCallisto, Commented Mar 27, 2014 at 16:27

Community · Accepted Answer · 2023-11-17 20:33:26Z

1

This is basic HTML form creation and processing. Any beginners PHP tutorial from the last 10+ years will show you how to do this. You will use method="GET" in your form tag.

Here's the tutorial from the PHP docs: https://www.php.net/manual/en/tutorial.forms.php

edited Nov 17, 2023 at 20:33

CommunityBot

11 silver badge

answered Mar 27, 2014 at 16:23

Scott Saunders

30.5k14 gold badges60 silver badges66 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

user3070626 Over a year ago

I have had a go at a form and using get, but its not working. Is this completely wrong? <?php session_start(); if($_SESSION['user'] != ""){?> <form action="process.php" method="get"> Add Place: <input type="text" 'name="action=addtoItinirary&UCty="> ' <input type="submit"> ' </form>

Scott Saunders Over a year ago

make the name of the text input just "UCty" and create a separate hidden field named "action" with a value of "addtoItinirary". And check your spelling of "Itinirary" to make sure it's consistent.

Darius · Accepted Answer · 2014-03-27 16:26:46Z

0

You could use GET to pass user input and add it to the URL. So when when user input is present replace process.php?action=addtoItinirary&UCty=Bangkok with process.php?action=addtoItinirary&UCty=UserCity

Just sanitize the user input afterwards.

answered Mar 27, 2014 at 16:26

Darius

1354 bronze badges

Collectives™ on Stack Overflow

User input string passed through a url

2 Answers 2

2 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related