Hi,
ok.
Here goes: a script to check user input:
function checkvar($var, $default, $type) // Test wether a variable meets require_oncements
{
switch($type)
{
case 1: // Variable should be an integer code
if($var == '')
{
$var = $default;
}
else
{
if(is_numeric($var))
{
$var = $var;
}
else
{
$var = $default;
}
}
break;
case 2: // text user input : prevent malicious code from running
if($var == '')
{
$var = $default;
}
else
{
$var = htmlspecialchars($var, ENT_NOQUOTES);
}
break;
}
return $var;
}
function getvar($getvar, $def, $typ) // function which will try to get a value from $_get or $_post array
{
$varuit1 = checkvar($_POST[$getvar], '-*-', $typ);
if($varuit1 != '-*-')
{
$varuit = checkvar($_POST[$getvar], '-*-', $typ);
}
else
{
$varuit1 = checkvar($_GET[$getvar], '-*-', $typ);
if($varuit1 != '-*-')
{
$varuit = checkvar($_GET[$getvar], '-*-', $typ);
}
else
{
$varuit = $def;
}
}
return $varuit;
}
Use this like:
$action = getvar('action', '', 2);
and it will check the posted variables, and the variables from the used link to see whether a variable called action exists, and whether it is a string.
Then..
In your links you have: "query=$query". But in the query you use something else. (Forgot what it was. Say that is category.
You would have to replace query=$query with: category=$category. This will pass the selected option to the next page.
J.
