how to send variables to a php file from within the url

marcnyc

Hello, I would like to know if there is a way (there has to be) to send variables to an php file from within an url...

In other words I have this login page with a form that has two fields (username & password)... I would like, through a link from another page, to send someone to the login page without having to actually log in. I'd like to be able to send the username and password with the url I use to link so that I can bypass the actual login...

I tried this: http://www.myurl.com/file.php?username=myname&password=mypassword

but it didn't work (of course I looked at the form's html to make sure that the field's variable names are actually called username and password...

Please let me know how to do this!

barand

http://www.myurl.com/file.php?username=myusername&password=mypassword

Your method of sending the varables should work. How are you trying to retrieve them in file.php?

If the variables $username and $password haven't been created automatically, try

$username = $_GET["username"];
$password = $_GET["password"];

marcnyc

That's the point I don't know how file.php handles or retrives the data as it is not my file and I don't have access to the code... I am just trying to allow myself to log in without having to actually log in... Do you know what I mean?

Angus

Paste everything between the form tags. Maybe there is a hidden field. Maybe they have a .htaccess check. Maybe your using the wrong case 🙂

Could be lots of reasons - need more info in order to help 🙂

marcnyc

You were right, there were hidden fields I didn't notice but I tried adding those to my url and it didn't work either...

Here is the code:

<FORM METHOD=POST ACTION="/file.php">
Username: <INPUT TYPE=text name=username value="">
<BR>
Password: <INPUT TYPE=password name=password size=12>
<BR>
<INPUT TYPE=HIDDEN name=y VALUE="2002">
<INPUT TYPE=HIDDEN name=m VALUE="10">
<INPUT TYPE=HIDDEN name=d VALUE="27">
<input type=hidden name=edit value=1>
<INPUT TYPE=submit value=Login></FORM>

I tried this:

http://www.myserver.com/file.php?username=myid&password=mypw&edit=1&y=2002&m=10&d=27

and it didn't work...

Arc

why does your actions say /file.php? There shouldnt be a forward slash in there.

Make sure your variables of the right case...php variables are case sensitive and that they have the $ in front of them...example:

If you have the variable $Password and the Variable $Username
you would do this. in your code.

$Password = "Blah";
$Username = "more blah";

Then in your URL you would put

http://www.myurl.com/file.php?Username=$Username&Password=$Password

so other than that i dont see whats wrong.

the_Igel

The problem that the form uses POST, whereas sending variables in URL is GET method. It depends on target php file, but probably it expects the variables to be sent with POST, not with random method. Then you can do nothing with it - I mean you can't pass them through URL.

Angus

I dont think that the form that processes would care if it was a POST or GET ? Unless the author has specifically set HTTP_POST_VARS ?

An easy alternative could be to save the form locally to your hard disk and hardcode your username and pass as the default variables and run it.

This quite often will work unless they have .htaccess protecting their site from external referers for whatever reason.

the_Igel

Originally posted by Angus
I dont think that the form that processes would care if it was a POST or GET ? Unless the author has specifically set HTTP_POST_VARS ?

I'd say "$_POST". And I'm sure it's quite common today, as it's superglogal so you don't need to declare it global. In my opinion, checking for referer is far more rare, as it doessn't provide high security anyway.

marcnyc

There is a forward slash simply because the file is in the root of the server, but it doens't matter, I could remove that, that's not the issue...

There are no $ signs in the variable names of the form and as you can see from the code I posted they are no capitals either but you got me thinking about the $ so I believe that what the script remotely does is probably to rename the variables sent via HTML form to be used in PHP, something like:

username = $uname

so if this assumption is right I guess I can't do anything else but store it locally as Angus suggested, which is not what I wanted to do though...

If anybody else has any idea on how to allow me to link without storing the form locally it would be highly appreciated...

barand

Further to Angus' suggestion of hard coding your username and password into a local form.

You could give the form an 'onopen' javascript handler to submit the form immedialtely and log you in, just by double-clicking a desktop icon.

But beware - any one else can also log in as you by opening such a form with the values hard coded. It's like sticking a post-it note on you monitor with your username and password on it!

marcnyc

That might be an idea.

The thing is that I wanted to put a link on my homepage, not an html file on my desktop.

Security is not an issue though, but thanks for reminding me...

So I guess there is no other way to do this than to hardcode it, eh? I guess... But I have one last question: if file.php?var=value is the way to send variables to a php file via url, isn't there an equal way to do this in html so I can send vars through an url to an html form to process??? If there is such way then I could just use the html link to send vars to an html form who will then process it through the php file, if you know what I mean...

Arc

Uhh.. i just re-read your question and the answer is quite simple.

At the top of the log in page put

<?php
If ( $Password == "Yerpassword" AND $Username == "YerUsername")
Print "<META HTTP-EQUIV=\"refresh\" CONTENT=\"0; URL=Thepageyouwant.htm\">";
?>

So when this page loads it will check the passed variables in your URL Example:http://www.myurl.com/file.php?Username=YerUsername&Password=YerPassword

and if they match it will load the page you specify... Ofcourse if you are using sessions to keep trak of correct log ins then you will have to take that into consideration.

marcnyc

Thanks Arc, but like I said I don't have access to the php file that contains the form...

Arc

Ohh well, it doesnt say that you dont ahve access to the php page in your original statement... in that case its not possible to do it thru the URL. WHich i gather you've figured out. 🙂

marcnyc

Actually Arc it does say it, not in the original statement but in my following one (the second post)...

I think the problem is simply this:

the variables in the PHP code I don't have access to are NOT called the same way the HTML form fields variables are... In other words even though I can see from the form that the username field variable is called username and the password field variable is called password, as soon as those two values are passed on to the PHP file for processing the variables are probably renamed, for example:

username = $id;
password = $pw;

of course I don't understand how PHP could accept a code where variables sent from the HTML form don't start with a $ sign but so far I think it is the only explanation...

If somebody disagrees I'll happily consider different theories and solutions!