[advanced search]
Results from the most recent live auction are here.
21 members in the live chat room. Join Chat!
Register Rules & FAQ NP$ Store Active Threads Mark Forums Read
Go Back   NamePros.Com > Design and Development > Programming
Reload this Page Get the FULL url in php [including "id=1" part..]
User Name
Password

Old 01-21-2007, 07:11 PM   · #1
unknowngiver
Senior Member
 
Name: Zubair
Location: Ontario Canada
Trader Rating: (53)
Join Date: May 2005
Posts: 2,754
NP$: 724.15 (Donate)
unknowngiver is a name known to allunknowngiver is a name known to allunknowngiver is a name known to allunknowngiver is a name known to allunknowngiver is a name known to allunknowngiver is a name known to all
Get the FULL url in php [including "id=1" part..]
Hey
Is it possible to get the FULL url that the user is on?
I made this login script..and redirects u back to the page u were on before..but it doesnt get the last part of the urll..for example if the user is on this page when they login:
http://localhost/index.php?action=viewmedia&id=1
after using :
$_SERVER['PHP_SELF'] they are redirected to index.php
how do i make it so it gets the Last part 2
Thanks


Please register or log-in into NamePros to hide ads
unknowngiver is offline   Reply With Quote
Old 01-21-2007, 07:14 PM   · #2
Dan
Buy my domains.
 
Dan's Avatar
 
Name: Dan
Trader Rating: (63)
Join Date: Feb 2006
Posts: 2,801
NP$: 54.00 (Donate)
Dan has a brilliant futureDan has a brilliant futureDan has a brilliant futureDan has a brilliant futureDan has a brilliant futureDan has a brilliant futureDan has a brilliant futureDan has a brilliant futureDan has a brilliant futureDan has a brilliant futureDan has a brilliant future
Autism Autism Autism Autism Autism Autism Autism
PHP Code:
$_SERVER['PHP_SELF'] . '?' . $_SERVER['QUERY_STRING'];
That would be like /index.php?action=viewmedia&id=1
Dan is offline   Reply With Quote
Old 01-22-2007, 12:33 AM   · #3
beaver6813
NamePros Regular
 
beaver6813's Avatar
 
Name: Sam Cleaver
Location: England
Trader Rating: (11)
Join Date: May 2005
Posts: 346
NP$: 59.50 (Donate)
beaver6813 is a jewel in the roughbeaver6813 is a jewel in the roughbeaver6813 is a jewel in the rough
Out of interest, why is it better to do it that way rather than just using $_SERVER['REQUEST_URI']?
__________________
-Beaver6813.com V5 Soon!
beaver6813 is offline   Reply With Quote
Old 01-22-2007, 04:29 AM   · #4
Dan
Buy my domains.
 
Dan's Avatar
 
Name: Dan
Trader Rating: (63)
Join Date: Feb 2006
Posts: 2,801
NP$: 54.00 (Donate)
Dan has a brilliant futureDan has a brilliant futureDan has a brilliant futureDan has a brilliant futureDan has a brilliant futureDan has a brilliant futureDan has a brilliant futureDan has a brilliant futureDan has a brilliant futureDan has a brilliant futureDan has a brilliant future
Autism Autism Autism Autism Autism Autism Autism
That's just what I could think of. >_____>
Dan is offline   Reply With Quote
Old 01-22-2007, 09:55 AM   · #5
stscac
A Wealth of Knowledge
 
stscac's Avatar
 
Trader Rating: (45)
Join Date: Aug 2004
Posts: 3,787
NP$: 2800.20 (Donate)
stscac has much to be proud ofstscac has much to be proud ofstscac has much to be proud ofstscac has much to be proud ofstscac has much to be proud ofstscac has much to be proud ofstscac has much to be proud ofstscac has much to be proud of
Originally Posted by Dan
PHP Code:
$_SERVER['PHP_SELF'] . '?' . $_SERVER['QUERY_STRING'];
That would be like /index.php?action=viewmedia&id=1


Definitely not the safest approach if you're querying a database with the $_GET contents.

Either clean it or use the switch() function

-Steve
stscac is offline   Reply With Quote
Old 01-22-2007, 10:02 AM   · #6
RegisterRants
DNOA Member
 
RegisterRants's Avatar
 
Name: Jason
Trader Rating: (11)
Join Date: Oct 2006
Posts: 1,143
NP$: 257.37 (Donate)
RegisterRants has a spectacular aura aboutRegisterRants has a spectacular aura aboutRegisterRants has a spectacular aura about
Not safe at all...especially if the $_GET[] array is evaluated

Code:

http://www.yourscript.com/?%24_SERVER%5B'QUERY_STRING'%5D+%3D+'%2Frestricted  %2Fpath'%3B


That would move the user to /restricted/path, where you obviously don't want him to go, if it is evaluated.
__________________
Web Development
RegisterRants is offline  
  Reply With Quote
Old 01-22-2007, 01:57 PM   · #7
Dan
Buy my domains.
 
Dan's Avatar
 
Name: Dan
Trader Rating: (63)
Join Date: Feb 2006
Posts: 2,801
NP$: 54.00 (Donate)
Dan has a brilliant futureDan has a brilliant futureDan has a brilliant futureDan has a brilliant futureDan has a brilliant futureDan has a brilliant futureDan has a brilliant futureDan has a brilliant futureDan has a brilliant futureDan has a brilliant futureDan has a brilliant future
Autism Autism Autism Autism Autism Autism Autism
No one said anything about making it safe.. Of course he should use something to clean it before using it in a MySQL query..
Dan is offline   Reply With Quote
Old 01-22-2007, 02:02 PM   · #8
RegisterRants
DNOA Member
 
RegisterRants's Avatar
 
Name: Jason
Trader Rating: (11)
Join Date: Oct 2006
Posts: 1,143
NP$: 257.37 (Donate)
RegisterRants has a spectacular aura aboutRegisterRants has a spectacular aura aboutRegisterRants has a spectacular aura about
What I posted above doesn't even need to be used in a mysql query to be effective.

Any statement that runs the 'eval();' command with $_SERVER['QUERY_STRING'] mentioned anywhere therein will fall victim to this.
__________________
Web Development
RegisterRants is offline  
  Reply With Quote
Old 01-22-2007, 02:18 PM   · #9
Dan
Buy my domains.
 
Dan's Avatar
 
Name: Dan
Trader Rating: (63)
Join Date: Feb 2006
Posts: 2,801
NP$: 54.00 (Donate)
Dan has a brilliant futureDan has a brilliant futureDan has a brilliant futureDan has a brilliant futureDan has a brilliant futureDan has a brilliant futureDan has a brilliant futureDan has a brilliant futureDan has a brilliant futureDan has a brilliant futureDan has a brilliant future
Autism Autism Autism Autism Autism Autism Autism
Originally Posted by JRBHosting
will fall victim to this.

Fall victim to what?.. All it does is say /restricted/path. Why would anyone eval() that variable and have it set up so that setting it to that would do something?..
Dan is offline   Reply With Quote
Old 01-22-2007, 02:19 PM   · #10
Matthew.
Stud Sausage
 
Location: England
Trader Rating: (25)
Join Date: Dec 2006
Posts: 1,545
NP$: 32.41 (Donate)
Matthew. has much to be proud ofMatthew. has much to be proud ofMatthew. has much to be proud ofMatthew. has much to be proud ofMatthew. has much to be proud ofMatthew. has much to be proud ofMatthew. has much to be proud ofMatthew. has much to be proud ofMatthew. has much to be proud of
Adoption Breast Cancer Breast Cancer Cancer Survivorship
Originally Posted by JRBHosting
What I posted above doesn't even need to be used in a mysql query to be effective.

Any statement that runs the 'eval();' command with $_SERVER['QUERY_STRING'] mentioned anywhere therein will fall victim to this.



That is if there is anyone out there silly enough to use eval on on anything that hasn't been checked, validated, and double checked a few times especially a superglobal of all things.

That is far beside the point anyway,

Personally, topic solved? Yes?
__________________
My NamePros Tools
(firefox plugin, google gadget etc)
Matthew. is offline   Reply With Quote
Old 01-22-2007, 02:23 PM   · #11
unknowngiver
Senior Member
 
Name: Zubair
Location: Ontario Canada
Trader Rating: (53)
Join Date: May 2005
Posts: 2,754
NP$: 724.15 (Donate)
unknowngiver is a name known to allunknowngiver is a name known to allunknowngiver is a name known to allunknowngiver is a name known to allunknowngiver is a name known to allunknowngiver is a name known to all
hm i cleaned it up using htmlspecialchars()
is it safe enough?
the only reason i m using this is because i have a login form on the right panel..so when some1 logs in..on any page..i want them to be redirected to the same page..and if they are in a page that has "id=1" or w.e...it doesnt redirect them to that ..if i just use $_SERVER['PHP_SELF']
i m using the way dan told me about..is that okay or should i switch to what beaver mentioned?
unknowngiver is offline   Reply With Quote
Old 01-22-2007, 02:25 PM   · #12
Dan
Buy my domains.
 
Dan's Avatar
 
Name: Dan
Trader Rating: (63)
Join Date: Feb 2006
Posts: 2,801
NP$: 54.00 (Donate)
Dan has a brilliant futureDan has a brilliant futureDan has a brilliant futureDan has a brilliant futureDan has a brilliant futureDan has a brilliant futureDan has a brilliant futureDan has a brilliant futureDan has a brilliant futureDan has a brilliant futureDan has a brilliant future
Autism Autism Autism Autism Autism Autism Autism
What beaver said could be "hacked" exactly the same way mine could.
Dan is offline   Reply With Quote
Old 01-22-2007, 02:25 PM   · #13
Matthew.
Stud Sausage
 
Location: England
Trader Rating: (25)
Join Date: Dec 2006
Posts: 1,545
NP$: 32.41 (Donate)
Matthew. has much to be proud ofMatthew. has much to be proud ofMatthew. has much to be proud ofMatthew. has much to be proud ofMatthew. has much to be proud ofMatthew. has much to be proud ofMatthew. has much to be proud ofMatthew. has much to be proud ofMatthew. has much to be proud of
Adoption Breast Cancer Breast Cancer Cancer Survivorship
Originally Posted by unknowngiver
hm i cleaned it up using htmlspecialchars()
is it safe enough?
the only reason i m using this is because i have a login form on the right panel..so when some1 logs in..on any page..i want them to be redirected to the same page..and if they are in a page that has "id=1" or w.e...it doesnt redirect them to that ..if i just use $_SERVER['PHP_SELF']
i m using the way dan told me about..is that okay or should i switch to what beaver mentioned?



Bottom line: Are you storing this string in a database? if no, it does not need to be secured. If so, stripslashes -> addslashes or another escaping function.

Both Dan and Beaver's suggestions are exact, only Dan was using the two pre defined variables for page name and query string where as Beaver's in pre-combined to give both.
__________________
My NamePros Tools
(firefox plugin, google gadget etc)
Matthew. is offline   Reply With Quote
Old 01-22-2007, 02:32 PM   · #14
RegisterRants
DNOA Member
 
RegisterRants's Avatar
 
Name: Jason
Trader Rating: (11)
Join Date: Oct 2006
Posts: 1,143
NP$: 257.37 (Donate)
RegisterRants has a spectacular aura aboutRegisterRants has a spectacular aura aboutRegisterRants has a spectacular aura about
I would personally do this:

Code:
header("Location: http://www.yoursite.com/yourscript.php?id=".htmlspecialchars(escape($_GET[id])));
__________________
Web Development
RegisterRants is offline  
  Reply With Quote
Old 01-22-2007, 02:33 PM   · #15
Matthew.
Stud Sausage
 
Location: England
Trader Rating: (25)
Join Date: Dec 2006
Posts: 1,545
NP$: 32.41 (Donate)
Matthew. has much to be proud ofMatthew. has much to be proud ofMatthew. has much to be proud ofMatthew. has much to be proud ofMatthew. has much to be proud ofMatthew. has much to be proud ofMatthew. has much to be proud ofMatthew. has much to be proud ofMatthew. has much to be proud of
Adoption Breast Cancer Breast Cancer Cancer Survivorship
Originally Posted by JRBHosting
I would personally do this:

Code:
header("Location: http://www.yoursite.com/yourscript.php?id=".htmlspecialchars(escape($_GET[id])));



Because multiple query string variables don't exist now?

Also why use htmlspecialchars here, and escape is not a function...
__________________
My NamePros Tools
(firefox plugin, google gadget etc)
Matthew. is offline   Reply With Quote
Old 01-22-2007, 02:42 PM   · #16
RegisterRants
DNOA Member
 
RegisterRants's Avatar
 
Name: Jason
Trader Rating: (11)
Join Date: Oct 2006
Posts: 1,143
NP$: 257.37 (Donate)
RegisterRants has a spectacular aura aboutRegisterRants has a spectacular aura aboutRegisterRants has a spectacular aura about
Ah...I wrote the escape function for use in one of my programs...that's why its there

In this EXAMPLE I would do that

I havent done this in a while...maybe substitute htmlspecialchars for addslashes.
__________________
Web Development
RegisterRants is offline  
  Reply With Quote
Old 01-22-2007, 03:04 PM   · #17
unknowngiver
Senior Member
 
Name: Zubair
Location: Ontario Canada
Trader Rating: (53)
Join Date: May 2005
Posts: 2,754
NP$: 724.15 (Donate)
unknowngiver is a name known to allunknowngiver is a name known to allunknowngiver is a name known to allunknowngiver is a name known to allunknowngiver is a name known to allunknowngiver is a name known to all
if i use htmlspecialchars and addslashes..would it be secure then?
unknowngiver is offline   Reply With Quote
Old 01-23-2007, 12:29 AM   · #18
beaver6813
NamePros Regular
 
beaver6813's Avatar
 
Name: Sam Cleaver
Location: England
Trader Rating: (11)
Join Date: May 2005
Posts: 346
NP$: 59.50 (Donate)
beaver6813 is a jewel in the roughbeaver6813 is a jewel in the roughbeaver6813 is a jewel in the rough
There are functions specially designed in PHP, if you're using MySQL, i use a couple on my scripts like:

PHP Code:
function quote_smart($value,$skip=0)
{
   if (get_magic_quotes_gpc()) {
       $value = stripslashes($value);
   }
   if (!is_numeric($value)) {
   if($skip==0){
       $value = "'" . mysql_real_escape_string($value) . "'";
       } else {
       $value = mysql_real_escape_string($value);
       }
   }
   return $value;
}


You can use lots of things to make strings safe, you could replace certain characters, use addslashes, stripslashes, htmlspecialcharacters, strip_tags... theres loads of stuff!

P.S (If you find anything wrong with the snippet of code above, lemme know so i can fix in my latest script
__________________
-Beaver6813.com V5 Soon!
beaver6813 is offline   Reply With Quote
Closed Thread

NamePros is a revenue sharing forum.
« Database normalization help.. | Iframe Help? »

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump


Site Sponsors
EscrowDNS RealTechNetwork RealTechNetwork
Advertise your business at NamePros
All times are GMT -7. The time now is 10:56 AM.

Advertise At NamePros - Contact Us - NamePros.Com - Archive -Privacy Statement -Top

Powered by: vBulletin Copyright ©2000 - 2008, Jelsoft Enterprises Ltd.
Search Engine Friendly URLs by vBSEO 2.4.0