Passing variables

silentway

The answer to this question is probably blindingly obvious, but is there any way of passing a variable from one script to another by clicking a hyperlink?

I currently have a self-processing page. I am wanting to pass a variable back to the script by clicking a hyperlink. One way is to use a GET query but I want to avoid GET because of security issues.

Another way to pass a variable from one script to another is by using POST variables, but these use a form whereas I want to use a hyperlink to send the variable, not a button in a form.

I have also tried to use session variables, but I can not figure out how to use a hyperlink to set the variable. At first I though that I could use some javascript to set the variable, but now I am thinking that this can not work.

Any suggestions?

paulnaj

Hi there,

The only difference between $GET and $POST is that $_POST doesn't append the data to the URL.

There is absolutely no difference in security whatsoever. Anyone who was interested in getting hold of the data, would have no problem with $_POST at all.

Having said that, you can get a link to set a hidden field on a form and submit the form using javascript. But, there are various considerations to be made, like what happens if the user hasn't got javascript turned on.

Paul.

silentway

Paul,

Many thanks.

I'll try out your suggestion of using a hidden field and using javascript to see how this works, but from what you say it looks as if GET and POST are not acceptable solutions anyway.

I think that session variables can be made more secure than either GET or POST variables. This is because session variables once set can not be overwritten by a query string.

All of this still leaves me with the problem of not knowing how to use javascript to set a PHP variable.

Can someone point me towards an example?

Andy

wilsonodk

There is no way of using JavaScript to set a PHP Session variable. Session varibles are typically sent using cookies though, so you could set a cookie with JavaScript and then read the cookie variable on the next page, setting the session variable at that time.

Also, Session isn't anymore or less secure than any other system. If security is a major concern you'll need to use https so that the traffic will be encrypted.

For more information on Sessions.

fugazzi007

I don't think GET is inherently vulnerable; sloppy coding is what makes using it vulnerable. In your case, I'm assuming you're hiding sensitive information unless the user is authenticated. Just make sure to make your logic granular enough that there is no default security hole.

silentway

I can see that I need to go back to the drawing board on this one. I did not like the idea of mixing Java Script and PHP anyway - much too messy!

I had thought that there must be a simple elegant solution that would get around a minor security issue.

Security is not overwhelmingly important (for my application at least!) so perhaps I shall go back to GET query strings which is where I started.

Many thanks to all.