replacement for urlencoding

[Anon]

I have some scripts that pass info via the url, eg,
<a href="script.php?var=variable">Script dependent on value of var</a>

script.php almost always has a line
$query="select * from db where id='$var'";

The problem is that the admin has turned off
register_globals which has broken this method.

Is there a simple replacement for this?
Suggestions on what to read in order to learn and
understand what to do next?

Thanks
B

[Anon]

// The right way
$query="select * from db where id='" . $_GET["var"] . "'";

or, if you must...

// Quickfix... add to top of script
$var = $_GET["var"];

The first is, of course, the recommended method.

-Josh

[Anon]

Register globals was turned off to increase the security of your scripts, therefore you should use $GET['var'] (or $HTTP_GET_VARS['var']) instead of just $var. Or $POST, $SERVER, $ENV for the post method, server variables and environment variables.

For more info read the release announcements for PHP 4.1.0

Diego