netscape vs explorer

[jacinthe]

as forever the battle will never end..

Hi everyone,

i have a form which produce a sql query. When i want to load another page with the query like this :

echo "<script language='JavaScript'>";

echo "window.location.href='my_page.php4?query=$recherche';";

echo "</script>";

it works fine with internet explorer and the function stripSlashes and addSlashes.

But when it comes to test it with netscape ohhhh god. The URL which is created look like this :

http://my_server/my_page.php4?query=select * from table_name

with internet explorer, spaces are replace with %20, but with netscape, it is replace with... spaces.

so when i want to use my variable $query with netscape, all i have is

select

can't reach the '* from table_name' and all the rest...

you know a way that i could do that?

also the functions addSlashes and stripSlashes don't seem to change anything with again netscape.

Thanx in advance,

Jacinthe

[cordex]

Look at urlencode()

[Anon]

Use rawurlencode() on the SQL. I must also point out that this is a serious security hole that would allow someone to paste "delete%20from%20tablename" onto your query string.

[cordex]

Agreed, this is a big security problem.

You know, you could store the query in a database and pass an autoid that links to the query. That would solve both problems.

-Ben

[jacinthe]

thanx for pointing out the security problem, even if the pages is "only" for the intranet, there's a lot of people who will use it...
Thanx for your helps guys