Passing a variable from a hyperlink

Anon

How do I make PHP pass a variable to the next page when a user clicks on a hyperlink?

For instance, I have this news system set up where all necessary info is in a MySQL database.

The main news page pulls the title of each news item out of the database and formats them accordingly.

I want it so that when a user clicks on the title of the news item, it takse them to the expanded version of that news item on a separate page with ONLY that news item showing.

Please help!

Anon

there are probably better ways to do this, but this is working for me.
this is the code that goes in a frame to allow users to select from a list of surnames. it creates links to individuals with that common surname. i echo'ed everything due to being somewhat of a newbie... and could not figure out all the parse errors i was getting..

<?PHP
$surname=mysql_query("SELECT DISTINCT LastName FROM individual ORDER BY LastName",$link)
or die("could not execute query");
while ($row=mysql_fetch_object($surname))
{
$selected_name=$row->LastName;
echo "<A HREF=\"selected_name.php?selected_name=";
echo $selected_name;
echo "\" TARGET=\"content\">";
echo $selected_name;
echo "</A><BR>";
};

this is from the selected_names.php file. it takes the variable sent in the links in the above file, and uses them in a query. then creates another set of links to the individuals:

<?PHP
$stmt="SELECT MainID, CONCAT(FirstName,' ',MiddleName,' ',LastName) as Name FROM individual WHERE LastName ='". $selected_name."'";
//notice the $selected_name variable from the first file? it took a few tries to get //the combination of single quotes and double quotes and the "." right..
$whole_name=mysql_query($stmt,$link)
or die("Query Failed");
while($row=mysql_fetch_object($whole_name,$link))
{
$selected_ID=$row->MainID;
//echo $selected_ID;
//echo " - ";
echo "<A HREF=\"selected_id.php?selected_ID=";
echo $selected_ID;
echo "\" TARGET=\"content\">";
echo $row->Name;
echo "</A><BR>";
};
?>

hope this gives you and idea on how to do what you are trying to do. oh yeah.. these are included in frames so the list of surnames is in the left frame and loads the content into the main frame...

Anon

Just create a query string in your anchor.

If you want to pass the News_ID to another page, use this:

echo "<a href=\"secondpage.php?News_ID=$News_ID\">Click here for full text</a>

Hope that helps...If you want to include more than one variable, seperate them with the ampersand, &

echo "<a href=\"secondpage.php?News_ID=$News_ID&Status=$Status\">Click here for printer friendly version</a>

---John Holmes...

Anon

When the variable to be passed is a password, then I don't want anyone can get my password, how can I do??

Anon

If you don't want it to be seen on the url, then you'll have to use a form with the method set to post. Note that either way, the password is still sent plain text. Just because you can't see it in the url, doesn't mean it's hidden. The only safe way to pass a password is over https, or by only passing the hash of the password. There is a javascript function that creates the md5 hash of a string. If you store your passwords in the database as md5 hashes, then you can get the hash using javascript, pass that, then compare the two. The plain text password is never sent over the web.

---John Holmes...

Anon

Use post can make the variable don't show on the URL, but it must use inside the form,

If I want to pass the variable by clicking on the word which then will redirect to other page, then can I use post in this moment?? Or other method I can use??

Anon

You can, but you're causing a lot of extra work for yourself. You have to create a form with hidden elements.

This will work...use php to put the actual password into the hidden element.

---John Holmes...

Anon

Thanks a lot, I will try it!!

Hope this method is safety enough!!

Anon

Hi,

I'm just looking at implementing something along these lines. The problem I saw with this is that okay, the password isn't sent plain text, but if the md5 hash is sniffed, then someone can just use that to get onside.

I could be really wrong, but it looks as if you're just making the password look different to what's typed.

A malicious user could intercept this and use it to gain entry to the real user's account, perhaps?

My current thinking is to have the server add (to the web page and the database) a random number each time the login is specified. The client then md5 hashes this and the username/password combo, and the server compares it with it's own hashed informaon.

Okay, so again someone could sniff this and use it to gain entry, but if you start using expiry/logout systems there's a chance of some slight security. I still wouldn't trust this for anything important.

sepodati

It doesn't matter if someone see's the md5() hash of your password. there's still no way to get the original password back. If they enter the hash as the password, it'll have the md5() taken of it again, and it won't match what's in the database.

When you fill out a form, the password is sent plain text anyhow, so they'll see the plain text password, not the md5() hash.

There is a javascript md5() function. You can use that to get the hash of the password, and then send the hash plain text. compare the two hashes to see if the password is correct. this way the regular password is never sent plain text.

---John Holmes...

Anon

If the malicious user is using the web page to send information to the server, then I can't help but agree with you. (Here we have to assume a safeguard against the disabling of javascript, but that's easy enough.)

Surely someone could send the http request via some other means than the web page? If you're using GET, not POST, this would be most easy. Not sure about POST..... but I believe it is probably trivial.

What if they altered the html of the webpage, and removed the javascript md5 hashing? As the page is on the client, it's hardly difficult to do that.

Excuse me if I'm taling rubbish here, by the way... I'm pretty new to this area, and I'm still working things out!

Tom.

Anon

This is exactly what I need to do. I have a page of news links for my community organization.

I have the page set where visitors can click on the event name and then I want to pass the event number through a URL so that the next page will display the complete event information.

The first part works with this URL:

But then on the contents.php page, I'm having trouble getting anything other than the event title to display!

This query displays everything:

<?php
$Host="";
$User = "";
$Password= "";
$DBName="";
$TableName= "news";
$display_order="display_order";

$Link = mysql_connect ($Host, $User, $Password);
$Query = "SELECT * from $TableName where display_order = $display_order";
$Result = mysql_db_query ($DBName, $Query, $Link);

while ($Row = mysql_fetch_array($Result))
{

print ("<H1 align="center">$Row[title]</H1>\n");
print ("$Row[newsStory]\n");
print ("\n");
}
mysql_close($Link);
?>

I know I'm doing something extremely simple and stupid wrong. There's something not right about how I'm using the variable (the event number) that I've passed.

Help, please.