get vs post

tazgalsinh

I have this table. It allows the user to click on the trainer so on the next page they can change the trainer themselves.

How can I change this so its user POST instead of GET. As currently on the next page any user can change the horses name themselves and change other owners details.

  <table width="50%" border="1" class="table_layout">
  <tr>
		<td colspan="4"><strong>Step 2.</strong> To edit trainer click Trainer's Name.</td>
	</tr>
    <tr>
      <td width="40%"><strong>Horse Name</strong></td>
      <td width="20%"><strong>Horse Age</strong></td>
      <td width="20%"><strong>Horse Height</strong></td>
      <td width="20%"><strong>Trainer Name</strong></td>
   </tr>

  <?php if(isset($selectedhorse)) {
  $resultb1 = mysql_query("SELECT HorseName, HorseAge, HorseHeight, TrainerName FROM JC_horse WHERE HorseName = '$selectedhorse' ORDER BY TrainerName");
  while($row=mysql_fetch_array($resultb1)) {

  		            echo "<tr>";
  			        echo "<td>" . (htmlspecialchars($row['HorseName'])) . "</td>\n";
  		            echo "<td>" . (htmlspecialchars($row['HorseAge'])) . "</td>\n";
  		            echo "<td>" . (htmlspecialchars($row['HorseHeight'])). "</td>\n";
  		              echo '<td><a href="change_trainer.php';
					echo '?horsename='.urlencode(htmlspecialchars($row['HorseName']));
					echo '&amp;trainername='.urlencode(htmlspecialchars($row['TrainerName'])). "\">";
		            echo (htmlspecialchars($row['TrainerName']))."</a></td>";

  		            echo "</tr>";
  } // end if
  } // end while

?>

thanks.

rincewind456

It would appear from this bit of code that you have register globals set on, not a good idea.

To change from GET to POST you will need to change your method in your form to POST, from GET and you will then have to change any variables
that are being referenced as $GET to $POST.

However in your case I think that you need to look at the manual link supplied above and change lines like this

 <?php if(isset($selectedhorse)) {

to look like this

 <?php if(isset($_POST['selectedhorse'])) {

as well as going through your code to see where your variables are getting assigned, for instance you use the $selectedhorse variable in your SQL query directly, again not a good idea. Take a look here to see the reasons why it's a bad idea.