Hiding of parameters....

Ton_Wibier

Hello you gurus!

First of all, let me wish ALL of you all the best for 2003 and all other years to come!
Also, I would like to compliment all the posters on the high quality of answers and questions. I tought myself PHP, thanks to this forum and its members.
How's that for kissing up to you!? ;oD

Okay, let's go down to business! I have this next problem.....eehhrrrr....challenge:
On a PHP-page I'm using hyperlinks to send users to a modify (WIJZIGEN) screen or give them the possibility to delete (VERWIJDER) a record. When this link is clicked upon the whole command shows up in the address bar of the browser. Is there a way to surpress this? I don't want people to see the parameters I'm sending to the modify/delete program.
Find a piece of the code below:

Some code before
|
|
<?php
mysql_connect("localhost","","");
mysql_select_db("database");
$SQLString = "SELECT * FROM bestand
ORDER BY volgnummer, omschrijving";
$Lijst = mysql_query(stripslashes($SQLString));

while ($regel = mysql_fetch_array($Lijst)):
$vlgnr = $regel['volgnummer'];
$omsch = $regel['omschrijving'];

echo " <table class=\"TableAttr\" align=\"center\">
<tr valign=\"top\">
<td width=\"10%\">$vlgnr</td>
<td width=\"70%\">$omsch</td>
<td width=\"10%\">
<center>
<a href=\"wijzigrub.php?wijzigrub=$vlgnr\" OnMouseOver='window.status=\"\"; return true'>Wijzigen</a>
</center>
</td>
<td width=\"10%\">
<center>
<a href=\"wisrub.php?wijzigrub=$vlgnr\" OnMouseOver='window.status=\"\"; return true'>Verwijder</a>
</center>
</td>
</tr>
</table>";

endwhile;
mysql_close();
?>
|
|
Some more code

The bold printed lines are the ones I'm talking about. When the user clicks on one of them, everything shows up in the adressbar of the browser. I would like to hide this.

How can this be done? Your answer is much appreciated.

Greetings from a COLD Netherlands!

GSHelpBoy

Try using onclick="window.status=''"

Ton_Wibier

GSHelpBoy, I'm already doing something like that with the command OnMouseOver, but this is for the STATUS bar. I also want to hide or cloak the command in the ADDRESS bar of the user's browser.

Thanks for your answer, anyway!

cgraz

Make the window open using javascript and show no address bar. http://htmlgoodies.earthweb.com/beyond/openwin.html has an example if you need.

The other option: use hidden inputs to pass the variables from page to page, and use the link that sends them to the modify page as a submit button to submit the form.

Cgraz

ppera

I seeked solution for it in last couple days, and I think that found pretty good one. Of course don't expect that hiding GET variables is safe from people who know tricks. If you want higher security level, use session variables.

When use frames, GET variables are invisible, that's the whole trick. So I have index.php, what is only container for 1 frame.
To ensure that refresh not returns always to initial page (index2.php) I wrote small script:

index.php starts with:

<? if (!session_is_registered('frpag')) session_register("frpag");
if (!isset($frpag)) $frpag = "index2.php" ; ?>

<frameset cols="" rows="">
<frame src="<? echo $frpag ?>" name="nav" frameborder="0" />.....

At begin of each page put this:

session_register("frpag"); $frpag = $PHP_SELF ;

I made it mostly from estetical reasons, since I have lot of parameters in hyperlinks, and it makes address bar full with ?$&+#'s 😃

ppera

Hehe...

With some little Java we can force that text link act as form, so we can use hidden variables. It's by Christopher S L Heng's text 'How to Make a Text Link Submit A Form ' .

Here is example with two variables:

This goes somewhere between head tags:

document.stform.submit() ;
}
-->
</script>

This is code for hyperlinks with 2 hidden variables:

$cs=..... #code for changing variable

Here is first 'variable' actually constant, but it's not relevant.

Variables will be sent as hidden, this is more secure than frame method. Just need to hide displaying from status bar too...

diego25

But still, one can just view source and find the "GET" (POST, really) variables there.

Also, do not confuse Java and JavaScript. They are 2 very different languages.

Diego

ppera

Right. This is not secure. Just to hide from address bar.
Actually there is no sense to send some secure datas with this twisted system, but via session variables. Or with variable encryption.

Ok, Javascript.... (so says in code :-) )