Passing Multiple variables via URL

tjandt

Hello,

I'm a complete n00b to PHP (and programming for that matter), and am having trouble passing multiple variables from one PHP sccript to another via a URL. I've read about sessions, and frankly, they confuse the heck out of me and seem way too advanced.

Here's what I'm trying to do:

echo "<tr bgcolor=$color><td>$id:</td><td>$question</td><td>[ <a href='editquiz.php?id=$id?table=$table'>edit</a>]

after clicking the edit link, I get an invalid fetch from the following code because it appears the table value isn't being passed properly.

$result = mysql_query("SELECT * FROM $table WHERE id=$id",$db);

If I do the following:

echo "ID is: " . $id . " and Table is " . $table . ".";

I get the following

ID is: 6?table=quiz and Table is .

If I change the original URL to read: editquiz.php?table=$table?id=$id

then it opens up the table properly, but does not open up the correct id.

Any idea how to pass two variables via a URL and have them both accessible?

Thanks,
TIm

jernhenrik

You are almost there.

http://<someserver>/editquiz.php?table=tbl1&id=id1&anothervar=xyz

Simply use & to separate additional variables you wish to pass along

harmor

You're setting yourself up for sql injections.

I could do
editquiz.php?table=admin SET name=foo WHERE id=1; #

If you had the table "admin" I could change the name to foo on id 1

edit:
nevermind, I can't do that string but I'm sure that your code is wating for a sql injection

tjandt

Thanks so much for the help. that was just what I needed!

tjandt

harmor wrote:
You're setting yourself up for sql injections.

I could do
editquiz.php?table=admin SET name=foo WHERE id=1; #

If you had the table "admin" I could change the name to foo on id 1

edit:
nevermind, I can't do that string but I'm sure that your code is wating for a sql injection

I'm not sure what sql injections are actually. If it makes any difference, this is not for a public site. I'm working on training documentation for work, and the boss wanted to have a quiz at the end of each training session. So this is all running from a single CD using server2go, and being used by internal employees. So if a sql injection is a security risk, I think this might still be ok.