php and javascript

[brattt]

I am trying to insert the value of a hidden field into the following php script:

<?
if($HTTP_POST_VARS['action']=="login"){
	if($totalRows_rsLogin==0){
		header("Location: client_signup_new.php");
		mysql_free_result($rsLogin);
	} else {
		mysql_free_result($rsLogin);
		session_register("userSession");
		$HTTP_SESSION_VARS['userSession'] = $HTTP_POST_VARS['username'];
		session_register("levelSession");
		$HTTP_SESSION_VARS['levelSession'] = $row_rsLogin['permissions'];
		header("Location: main_authenticate.php?".$jvar);
	}
}

?>

At the third to last line I need the 'location' to be "main_authenticate.php?" and then the value of a hidden field in a form on my page. i.e. the $jvar would represent something like "document.myform.mytext.value"

Anyone got some advice as to how this might be achieved?

[void_function]

<input type="hidden" name="jvar" id="jvar">

...

javascript: document.getElementById("jvar").value= valueyouwanttopass;

...

PHP: $jvar= $_POST['jvar']; // Or use HTTP_POST_VARS if you so desire

[brattt]

Thanks very much for responding CodeGhoul. Please forgive my ignorance but how would I go about concatenaing the location string? Would it be something like:

<?
if($HTTP_POST_VARS['action']=="login"){
        $jvar= $_POST['jvar']; 
	if($totalRows_rsLogin==0){
		header("Location: client_signup_new.php");
		mysql_free_result($rsLogin);
	} else {
		mysql_free_result($rsLogin);
		session_register("userSession");
		$HTTP_SESSION_VARS['userSession'] = $HTTP_POST_VARS['username'];
		session_register("levelSession");
		$HTTP_SESSION_VARS['levelSession'] = $row_rsLogin['permissions'];
		header("Location: main_authenticate.php?".$jvar);
	}
}

?>

[void_function]

Well, note that variables are passed via URL in the form of ?key=val&key2=val2...

So if your $jvar contains the value, the location string is:

"Location: main_authenticate.php?variable_name=$jvar"

Of course, the name of the variable_name depends on your code logic and is yours to decide. It is the name that you will fetch with $_GET['variable_name'] in main_authenticate.php

[brattt]

actually I'm getting the variable name out of the url address in the main_authenticate.php page i.e.

<script language="JavaScript">
document.myform.mytext.value = location.search.substring(1);
</script>

[void_function]

Then your original solution, "Location: main_authenticate.php?$jvar" is ok, except you must validate the $jvar (in PHP) before you include it in this header, since this implementation is open for attacks, ie. you have to check that it spells "key=value" and that both key and value are of accepted values and value TYPES (ie. integers are integers and strings do not contain HTML or SQL injection codes). Do some preg_match()-ing to do that.

[brattt]

Thanks very much for your help mate. I've give it whirl in the morning and see how I go.