problem passing two word variable

rfigley

I'm trying to pass a variable from one page to the next to be used in a final query on a third page.

The variable is one to 3 words. It is selected via pulldown menu, then is taken to the page of the next pulldown, which is a name selection and is two words. Both of these go to the final query where they are both used in a query.

The first variable keeps getting cut off to only one word. The second one stays in tact with it's two words. If the first variable is only one word, there is no problem and the query on the 3rd page works fine. But if its 2 or more of course the query doesn;t work. I am using
<input type=hidden name=field_name value=$variable>

to pass it from the second page to the 3rd page to be used in the query, but as I said, keeps getting cut to the first word only. What am I missing here?

floR

The quotes around value="$variable".

Weedpacket

...and the quotes around the other attribute values (now you know why the standard says they should be there!)

If there's the slightest possibility that $variable might contain quotes or other potentially damaging characters of its own,

<input type="hidden" name="field_name" value="<?php echo htmlspecialchars($variable)?>">

MrAlaska

Originally posted by rfigley
I'm trying to pass a variable from one page to the next to be used in a final query on a third page.
...

If you are inserting client side variables directly into a SQL statement, that is a bad policy. Even with other precautions in place, you are giving the user the ability to modify the SQL statement and chip away at your security.